Write an OPA Gatekeeper ConstraintTemplate and Constraint to require resource labels

Steps

1. Create a `ConstraintTemplate` manifest with `apiVersion: templates.gatekeeper.sh/v1` (v1 is current since Gatekeeper 3.6.0) and define the Rego policy in `spec.targets[].rego`.
2. The Rego in the template must use `package` matching the `spec.crd.spec.names.kind` lowercased, and define a `violation[{"msg": msg}]` rule.
3. Apply the ConstraintTemplate with `kubectl apply -f constraint-template.yaml`; Gatekeeper CRDs the generated constraint kind within seconds.
4. Create a `Constraint` manifest using the new CRD kind (e.g., `kind: K8sRequiredLabels`) referencing the ConstraintTemplate by its kind, listing required label keys in the parameters.
5. Test the constraint by applying a non-compliant resource and confirming Gatekeeper returns an admission denial message.
6. Use `kubectl get constraints` and `kubectl describe <ConstraintKind> <name>` to view violation counts and recent audit results.