Kubernetes: add metadata to manifest based on rules/labels
An admission controller seems like a suitable solution to your requirement : https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#validatingadmissionwebhook-alpha-in-18-beta-in-19