Disallow NodePort

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-nodeport
  annotations:
    policies.kyverno.io/title: Disallow NodePort
    policies.kyverno.io/category: Best Practices
    policies.kyverno.io/minversion: 1.6.0
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Service
    policies.kyverno.io/description: A Kubernetes Service of type NodePort uses a host port to receive traffic from any source. A NetworkPolicy cannot be used to control traffic to host ports. Although NodePort Services can be useful, their use must be limited to Services with additional upstream security checks. This policy validates that any new Services do not use the `NodePort` type.
spec:
  validationFailureAction: Audit
  background: true
  rules:
    - name: validate-nodeport
      match:
        any:
          - resources:
              kinds:
                - Service
      validate:
        message: Services of type NodePort are not allowed.
        pattern:
          spec:
            "=(type)": "!NodePort"