apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-default-namespace
  annotations:
    policies.kyverno.io/title: Disallow application workloads in default
    policies.kyverno.io/category: Namespace hygiene
    policies.kyverno.io/severity: medium
    # Supplemental namespace-isolation control. This is not a one-to-one CIS control.
    policies.kyverno.io/cis-control: "supplemental"
spec:
  validationFailureAction: Enforce
  background: false
  failurePolicy: Fail
  rules:
    - name: application-resources-not-in-default
      match:
        any:
          - resources:
              kinds:
                - Pod
                - Deployment
                - StatefulSet
                - DaemonSet
                - Job
                - CronJob
                - ReplicaSet
                - ReplicationController
                - Service
                - Ingress
              namespaceSelector:
                matchLabels:
                  kubernetes.io/metadata.name: default
      validate:
        message: Application resources must be deployed into an explicitly named namespace.
        deny:
          conditions:
            any:
              - key: "{{ request.namespace }}"
                operator: Equals
                value: default