nodepool-selector-affinites-notexist-clusterpolicy.yaml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: nodepool-selector-affinites-notexist
  annotations:
    pod-policies.kyverno.io/autogen-controllers: none
spec:
  rules:
  - name: nodepool-selector-affinites-notexist
    match:
      any:
      - resources:
          annotations:
              example.com/nodepool: "*"
          kinds:
          - Pod
          namespaceSelector:
            matchLabels:
              example.com/match: "true"
          operations:
          - CREATE
    exclude:
        any:
        - resources:
            annotations:
              example.com/nodepool-selector-affinites: "true"
    preconditions:
      any:
      - key: "{{ request.object.spec.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms || '' }}"
        operator: Equals
        value: ""
    mutate:
      patchesJson6902: |-
        - op: add
          path: "/metadata/annotations/example.com~1nodepool-selector-affinites"
          value: "true"
        - path: "/spec/affinity/nodeAffinity/requiredDuringSchedulingIgnoredDuringExecution/nodeSelectorTerms/-1/matchExpressions/-1"
          op: add
          value:
            key: example.com/nodepool
            operator: In
            values :
            - '{{ request.object.metadata.annotations."example.com/nodepool" }}'