verify-git-repositories.yaml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-git-repositories
spec:  
  # This provides users a working example of how an admin
  # would be able to enforce git repository sources across
  # all tenants.
  validationFailureAction: Audit # Change to 'Enforce' once the specific org url is set.
  rules:
    - name: github-repositories-only
      match:
        any:
        - resources:
            kinds:
              - GitRepository
      exclude:
        any:
        - resources:
            namespaces:
              - flux-system
      validate:
        message: ".spec.url must be from a repository within the organisation X"
        pattern:
          spec:
            url: https://github.com/fluxcd/?* | ssh://git@github.com:fluxcd/?*