Cleanup Bare Pods

apiVersion: policies.kyverno.io/v1alpha1
kind: DeletingPolicy
metadata:
  name: clean-bare-pods
  annotations:
    policies.kyverno.io/title: Cleanup Bare Pods
    policies.kyverno.io/category: Other
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Pod
    kyverno.io/kyverno-version: 1.15.0
    policies.kyverno.io/minversion: 1.15.0
    pod-policies.kyverno.io/autogen-controllers: none
    kyverno.io/kubernetes-version: 1.27+
    policies.kyverno.io/description: A bare Pod is any Pod created directly and not owned by a controller such as a Deployment or Job. Bare Pods are often create manually by users in an attempt to troubleshoot an issue. If left in the cluster, they create clutter, increase cost, and can be a security risk. Bare Pods can be cleaned up periodically through use of a policy. This policy finds and removes all bare Pods across the cluster.
spec:
  matchConstraints:
    resourceRules:
      - apiGroups:
          - ""
        apiVersions:
          - v1
        resources:
          - pods
  conditions:
    - name: is-bare-pod
      expression: "!has(object.metadata.ownerReferences) || size(object.metadata.ownerReferences) == 0"
  schedule: "*/5 * * * *"