From f9601c1779cb95c4346622ffa59856c6101b5fab Mon Sep 17 00:00:00 2001
From: devshinthant <shinthantequi@gmail.com>
Date: Thu, 25 Jun 2026 13:27:47 +0700
Subject: [PATCH] chore: add kyverno validation policy

---
 apps/kyverno-policies.yaml                | 21 +++++++++++++++++++++
 charts/node-api/templates/deployment.yaml |  1 +
 platform/policies/check-labels.yaml       | 16 ++++++++++++++++
 3 files changed, 38 insertions(+)
 create mode 100644 apps/kyverno-policies.yaml
 create mode 100644 platform/policies/check-labels.yaml

diff --git a/apps/kyverno-policies.yaml b/apps/kyverno-policies.yaml
new file mode 100644
index 0000000..3ed64f9
--- /dev/null
+++ b/apps/kyverno-policies.yaml
@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: kyverno-policies
+  namespace: argo-cd
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/devshinthant/internal-developer-platform.git
+    targetRevision: main
+    path: platform/policies
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: kyverno
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+
diff --git a/charts/node-api/templates/deployment.yaml b/charts/node-api/templates/deployment.yaml
index 3762944..025dd5b 100644
--- a/charts/node-api/templates/deployment.yaml
+++ b/charts/node-api/templates/deployment.yaml
@@ -13,6 +13,7 @@ spec:
     metadata:
       labels:
         app: node-api
+        environment: dev
     spec:
       containers:
         - name: node-api
diff --git a/platform/policies/check-labels.yaml b/platform/policies/check-labels.yaml
new file mode 100644
index 0000000..0d12a23
--- /dev/null
+++ b/platform/policies/check-labels.yaml
@@ -0,0 +1,16 @@
+apiVersion: policies.kyverno.io/v1
+kind: ValidatingPolicy
+metadata:
+  name: check-labels
+spec:
+  validationActions:
+    - Deny
+  matchConstraints:
+    resourceRules:
+      - apiGroups: ["apps"]
+        apiVersions: ["v1"]
+        operations: ["CREATE", "UPDATE"]
+        resources: ["deployments"]
+  validations:
+    - message: label 'environment' is required
+      expression: "'environment' in object.metadata.?labels.orValue({})"