From b890d131a63690650b95a96c2cb718d3d5806a09 Mon Sep 17 00:00:00 2001
From: swaphb <s@swaphb.com>
Date: Mon, 10 Aug 2026 17:41:55 -0400
Subject: [PATCH] fix kyverno boolean and resource validation

---
 policies/kyverno/require-non-root.yaml        | 37 ++++++++++---------
 policies/kyverno/require-resource-limits.yaml | 29 +++++----------
 2 files changed, 30 insertions(+), 36 deletions(-)

diff --git a/policies/kyverno/require-non-root.yaml b/policies/kyverno/require-non-root.yaml
index c37af75..c5e24b2 100644
--- a/policies/kyverno/require-non-root.yaml
+++ b/policies/kyverno/require-non-root.yaml
@@ -23,20 +23,23 @@ spec:
                 matchLabels:
                   security-baseline/open: "true"
       validate:
-        message: Containers must explicitly set runAsNonRoot=true.
-        foreach:
-          - list: request.object.spec.containers[]
-            deny:
-              conditions:
-                any:
-                  - key: "{{ element.securityContext.runAsNonRoot || false }}"
-                    operator: Equals
-                    value: false
-          - list: request.object.spec.initContainers[]
-            deny:
-              conditions:
-                any:
-                  - key: "{{ element.securityContext.runAsNonRoot || false }}"
-                    operator: Equals
-                    value: false
-
+        message: Pods and containers must run as non-root.
+        # Accept either a Pod-level setting with no container override, or an
+        # explicit true value on every container and init container.
+        anyPattern:
+          - spec:
+              securityContext:
+                runAsNonRoot: true
+              containers:
+                - =(securityContext):
+                    =(runAsNonRoot): true
+              =(initContainers):
+                - =(securityContext):
+                    =(runAsNonRoot): true
+          - spec:
+              containers:
+                - securityContext:
+                    runAsNonRoot: true
+              =(initContainers):
+                - securityContext:
+                    runAsNonRoot: true
diff --git a/policies/kyverno/require-resource-limits.yaml b/policies/kyverno/require-resource-limits.yaml
index 17ffa53..3659883 100644
--- a/policies/kyverno/require-resource-limits.yaml
+++ b/policies/kyverno/require-resource-limits.yaml
@@ -27,23 +27,14 @@ spec:
         message: Every container must define CPU and memory limits.
         foreach:
           - list: request.object.spec.containers[]
-            deny:
-              conditions:
-                any:
-                  - key: "{{ element.resources.limits.cpu || '' }}"
-                    operator: Equals
-                    value: ""
-                  - key: "{{ element.resources.limits.memory || '' }}"
-                    operator: Equals
-                    value: ""
+            pattern:
+              resources:
+                limits:
+                  cpu: "?*"
+                  memory: "?*"
           - list: request.object.spec.initContainers[]
-            deny:
-              conditions:
-                any:
-                  - key: "{{ element.resources.limits.cpu || '' }}"
-                    operator: Equals
-                    value: ""
-                  - key: "{{ element.resources.limits.memory || '' }}"
-                    operator: Equals
-                    value: ""
-
+            pattern:
+              resources:
+                limits:
+                  cpu: "?*"
+                  memory: "?*"