nodepool-selector-tolerations-cluserpolicy.yaml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: nodepool-selector-tolerations
  annotations:
    pod-policies.kyverno.io/autogen-controllers: none
spec:
  rules:
  - name: nodepool-selector-tolerations
    match:
      any:
      - resources:
          annotations:
              example.com/nodepool: "*"
          kinds:
          - Pod
          namespaceSelector:
            matchLabels:
              example.com/match: "true"
          operations:
          - CREATE
    exclude:
        any:
        - resources:
            annotations:
              example.com/nodepool-selector-tolerations: "true"
    preconditions:
      any:
      - key: example.com/nodepool
        operator: AnyNotIn
        value: "{{ request.object.spec.tolerations[].key || [] }}"
    mutate:
      patchesJson6902: |-
        - op: add
          path: "/metadata/annotations/example.com~1nodepool-selector-tolerations"
          value: "true"
        - op: add
          path: "/spec/tolerations/-"
          value:
            key: example.com/nodepool
            operator: Equal
            value: '{{ request.object.metadata.annotations."example.com/nodepool" }}'
            effect: NoSchedule