verify-git-repositories.yaml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-git-repositories
spec:  
  # This provides users a working example of how an admin
  # would be able to enforce git repository sources across
  # all tenants.
  validationFailureAction: Audit # Change to 'Enforce' once the specific org url is set.
  rules:
    - name: github-repositories-only
      exclude:
        resources:
          namespaces:
            - flux-system
      match:
        any:
        - resources:
            kinds:
              - GitRepository
      validate:
        message: ".spec.url must be from a repository within the organisation X"
        anyPattern:
        - spec:
            url: "https://github.com/fluxcd/?*" # repositories in fluxcd via https
        - spec:
            url: "ssh://git@github.com:fluxcd/?*" # repositories in fluxcd via ssh