check.yaml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: validate-networkpolicy-namespace-selector
spec:
  validationFailureAction: Enforce
  rules:
  - name: validate-networkpolicy-namespace-selector
    match:
      resources:
        kinds:
        - NetworkPolicy
    validate:
      message: "The namespaceSelector in NetworkPolicy must use 'kubernetes.io/metadata.name'"
      anyPattern:
      - spec:
          ingress:
          - from:
            - namespaceSelector:
                matchLabels:
                  kubernetes.io/metadata.name: "?*"
      - spec:
          egress:
          - to:
            - namespaceSelector:
                matchLabels:
                  kubernetes.io/metadata.name: "?*"

compliant-netpol.yaml

---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: compliant-network-policy
  namespace: example-namespace-1
spec:
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: example-namespace-2

kyverno-test.yaml

name: validate-namespace-selector
policies:
  - check.yaml
resources:
  - compliant-netpol.yaml
  - non-compliant-netpol.yaml
results:
  - policy: validate-networkpolicy-namespace-selector
    rule: validate-networkpolicy-namespace-selector
    kind: NetworkPolicy
    resource: compliant-network-policy
    status: pass
  - policy: validate-networkpolicy-namespace-selector
    rule: validate-networkpolicy-namespace-selector
    kind: NetworkPolicy
    resource: non-compliant-network-policy
    status: fail

non-compliant-netpol.yaml

---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: non-compliant-network-policy
  namespace: example-namespace-1
spec:
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          some-random-attribute: example-value