{
  "apiVersion": "json.kyverno.io/v1alpha1",
  "kind": "ValidatingPolicy",
  "metadata": {
    "name": "require-tagging-standard",
    "annotations": {
      "nova.cloudinit.dev/severity": "medium",
      "title.policy.kyverno.io": "All resources carry required Nova tags"
    }
  },
  "spec": {
    "rules": [
      {
        "name": "require-nova-tags",
        "identifier": "id",
        "assert": {
          "all": [
            {
              "check": {
                "~.resources": {
                  "(contains(keys(inputs.tags || `{}`), 'nova:owner'))": true,
                  "(contains(keys(inputs.tags || `{}`), 'nova:contract'))": true,
                  "(contains(keys(inputs.tags || `{}`), 'nova:environment'))": true,
                  "(contains(keys(inputs.tags || `{}`), 'nova:cost-center'))": true
                }
              }
            }
          ]
        }
      }
    ]
  }
}