I am trying to implement VMRule which will alert when some pod, deployment, daemonset, statefulset or namespace, which name contains ‘tmp’ substring, will be detected. But I am not sure if it is a proper expression to solve the task described above. Maybe somebody have an ideas?

apiVersion: operator.victoriametrics.com/v1beta1
kind: VMRule
metadata:
  name: tmp-instance-detected
  labels:
    project: main
spec:
  groups:
  - name: vm-health
    rules:
      - alert: TmpInstanceDetected
        expr: changes(process_start_time_seconds{job=~".*tmp.*", kubernetes="*"}[15m]) > 0
        labels:
          severity: S3
        annotations:
          summary: "Tmp instance detected: {{ $labels.job }} (pod {{ $labels.pod }})"
          description: "A job or instance with 'tmp' in its name (instance {{ $labels.instance }}, pod {{ $labels.pod }}) has been detected."