Organization policy match section

# excludedNamespaces <array>: ExcludedNamespaces is a list of namespace names.
# If defined, a constraint only applies to resources not in a listed namespace.
# ExcludedNamespaces also supports a prefix or suffix based glob.  For example,
# `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`,
# and `excludedNamespaces: [*-system]` matches both `kube-system` and
# `gatekeeper-system`.
excludedNamespaces:
  # <list item: string>: A string that supports globbing at its front or end.
  # Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will
  # match "kube-system" or "gatekeeper-system".  The asterisk is required for
  # wildcard matching.
  - <string>
kinds:
  # <list item: object>: Kinds accepts a list of objects with apiGroups and
  # kinds fields that list the groups/kinds of objects to which the mutation
  # will apply. If multiple groups/kinds objects are specified, only one match
  # is needed for the resource to be in scope.
  - # apiGroups <array>: APIGroups is the API groups the resources belong to.
    # '*' is all groups. If '*' is present, the length of the slice must be
    # one. Required.
    apiGroups:
      - <string>
    kinds:
      - <string>
# labelSelector <object>: LabelSelector is the combination of two optional
# fields: `matchLabels` and `matchExpressions`.  These two fields provide
# different methods of selecting or excluding k8s objects based on the label
# keys and values included in object metadata.  All selection expressions from
# both sections are ANDed to determine if an object meets the cumulative
# requirements of the selector.
labelSelector:
  # matchExpressions <array>: matchExpressions is a list of label selector
  # requirements. The requirements are ANDed.
  matchExpressions:
    # <list item: object>: A label selector requirement is a selector that
    # contains values, a key, and an operator that relates the key and values.
    - # key <string>: key is the label key that the selector applies to.
      key: <string>
      # operator <string>: operator represents a key's relationship to a set
      # of values. Valid operators are In, NotIn, Exists and DoesNotExist.
      operator: <string>
      # values <array>: values is an array of string values. If the operator
      # is In or NotIn, the values array must be non-empty. If the operator
      # is Exists or DoesNotExist, the values array must be empty. This array
      # is replaced during a strategic merge patch.
      values:
        - <string>
  # matchLabels <object>: matchLabels is a map of {key,value} pairs. A single
  # {key,value} in the matchLabels map is equivalent to an element of
  # matchExpressions, whose key field is "key", the operator is "In", and the
  # values array contains only "value". The requirements are ANDed.
  matchLabels:
    [key]: <string>
# name <string>: Name is the name of an object.  If defined, it will match
# against objects with the specified name.  Name also supports a prefix or
# suffix glob.  For example, `name: pod-*` would match both `pod-a` and
# `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`.
name: <string>
# namespaceSelector <object>: NamespaceSelector is a label selector against an
# object's containing namespace or the object itself, if the object is a
# namespace.
namespaceSelector:
  # matchExpressions <array>: matchExpressions is a list of label selector
  # requirements. The requirements are ANDed.
  matchExpressions:
    # <list item: object>: A label selector requirement is a selector that
    # contains values, a key, and an operator that relates the key and values.
    - # key <string>: key is the label key that the selector applies to.
      key: <string>
      # operator <string>: operator represents a key's relationship to a set
      # of values. Valid operators are In, NotIn, Exists and DoesNotExist.
      operator: <string>
      # values <array>: values is an array of string values. If the operator
      # is In or NotIn, the values array must be non-empty. If the operator
      # is Exists or DoesNotExist, the values array must be empty. This array
      # is replaced during a strategic merge patch.
      values:
        - <string>
  # matchLabels <object>: matchLabels is a map of {key,value} pairs. A single
  # {key,value} in the matchLabels map is equivalent to an element of
  # matchExpressions, whose key field is "key", the operator is "In", and the
  # values array contains only "value". The requirements are ANDed.
  matchLabels:
    [key]: <string>
# namespaces <array>: Namespaces is a list of namespace names. If defined, a
# constraint only applies to resources in a listed namespace.  Namespaces also
# supports a prefix or suffix based glob.  For example, `namespaces: [kube-*]`
# matches both `kube-system` and `kube-public`, and `namespaces: [*-system]`
# matches both `kube-system` and `gatekeeper-system`.
namespaces:
  # <list item: string>: A string that supports globbing at its front or end.
  # Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will
  # match "kube-system" or "gatekeeper-system".  The asterisk is required for
  # wildcard matching.
  - <string>
# scope <string>: Scope determines if cluster-scoped and/or namespaced-scoped
# resources are matched.  Accepts `*`, `Cluster`, or `Namespaced`. (defaults to
# `*`)
scope: <string>
# source <string>: Source determines whether generated or original resources
# are matched. Accepts `Generated`|`Original`|`All` (defaults to `All`). A
# value of `Generated` will only match generated resources, while `Original`
# will only match regular resources.
# Allowed Values: All, Generated, Original
source: <string>