How to check manifests only labels

[Minivolk02]

Question

Hi, I have two clusterimagepolicies

apiVersion: policy.sigstore.dev/v1alpha1 kind: ClusterImagePolicy metadata: name: image-policy-objectmeta spec: mode: warn match: - resource: deployments version: v1 group: apps selector: matchLabels: group: back images:

• glob: "nginx" authorities:
  • static: action: fail

---

apiVersion: policy.sigstore.dev/v1beta1 kind: ClusterImagePolicy metadata: name: image-policy-default spec: images:

• glob: "**" authorities:
  • static: action: pass

And one deployment: apiVersion: apps/v1 kind: Deployment metadata: name: nginx-deployment spec: selector: matchLabels: app: nginx replicas: 1 template: metadata: labels: app: nginx group: back spec: containers: - name: nginx image: nginx:1.14.2 ports: - containerPort: 80

I want to check image only if manifest have label : group: back , and others manifests should not fail, how get it? Now it doesnt work i dont know why please help me