nodepool-selector-clusterpolicy.yaml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: nodepool-selector
  annotations:
    pod-policies.kyverno.io/autogen-controllers: none
spec:
  rules:
  - name: nodepool-selector
    match:
      any:
      - resources:
          annotations:
              example.com/nodepool: "*"
          kinds:
          - Pod
          namespaceSelector:
            matchLabels:
              example.com/match: "true"
    exclude:
        any:
        - resources:
            annotations:
              example.com/nodepool-selector: "true"
    preconditions:
      any:
      - key: example.com/nodepool
        operator: AnyNotIn
        value: "{{ request.object.spec.tolerations[].key || [] }}"
    mutate:
      patchesJson6902: |-
        - op: add
          path: "/metadata/annotations/example.com~1nodepool-selector"
          value: "true"
        - op: add
          path: "/spec/tolerations/-"
          value:
            key: example.com/nodepool
            operator: Equal
            value: '{{ request.object.metadata.annotations."example.com/nodepool" }}'
            effect: NoSchedule
        - path: "/spec/affinity/nodeAffinity/requiredDuringSchedulingIgnoredDuringExecution/nodeSelectorTerms/-1/matchExpressions/-1"
          op: add
          value:
            key: example.com/nodepool
            operator: In
            values :
            - '{{ request.object.metadata.annotations."example.com/nodepool" }}'