{
  "properties": {
    "displayName": "[Limited Preview]: Enforce labels on pods in AKS",
    "policyType": "BuiltIn",
    "mode": "Microsoft.ContainerService.Data",
    "description": "This policy enforces all the specified labels are provided for pods in an Azure Kubernetes Service cluster. Limited Preview policies only work for registered subscriptions. To register, please go to https://aka.ms/akspolicyonboarding. For instruction on using this policy, please go to https://aka.ms/akspolicydoc.",
    "metadata": {
      "category": "Kubernetes service"
    },
    "parameters": {
      "commaSeparatedListOfLabels": {
        "type": "String",
        "metadata": {
          "displayName": "Comma-separated list of labels",
          "description": "A comma-separated list of labels to be specified on Pods in Kubernetes cluster. E.g. test1,test2"
        }
      },
      "effect": {
        "type": "String",
        "defaultValue": "EnforceRegoPolicy",
        "allowedValues": [ "EnforceRegoPolicy", "Disabled" ],
        "metadata": {
          "displayName": "Effect",
          "description": "Enable or disable the execution of the policy"
        }
      }
    },
    "policyRule": {
      "if": {
        "field": "type",
        "equals": "Microsoft.ContainerService/managedClusters"
      },
      "then": {
        "effect": "[parameters('effect')]",
        "details": {
          "policyId": "PodEnforceLabels",
          "policy": "https://raw.githubusercontent.com/Azure/azure-policy/master/built-in-references/KubernetesService/pod-enforce-labels/limited-preview/gatekeeperpolicy.rego",
          "policyParameters": {
            "commaSeparatedListOfLabels": "[parameters('commaSeparatedListOfLabels')]"
          }
        }
      }
    }
  },
  "id": "/providers/Microsoft.Authorization/policyDefinitions/16c6ca72-89d2-4798-b87e-496f9de7fcb7",
  "name": "16c6ca72-89d2-4798-b87e-496f9de7fcb7"
}