fix kyverno boolean and resource validation

policies/kyverno/require-non-root.yaml

@@ -23,20 +23,23 @@ spec:
                 matchLabels:
                   security-baseline/open: "true"
       validate:
-        message: Containers must explicitly set runAsNonRoot=true.
-        foreach:
-          - list: request.object.spec.containers[]
-            deny:
-              conditions:
-                any:
-                  - key: "{{ element.securityContext.runAsNonRoot || false }}"
-                    operator: Equals
-                    value: false
-          - list: request.object.spec.initContainers[]
-            deny:
-              conditions:
-                any:
-                  - key: "{{ element.securityContext.runAsNonRoot || false }}"
-                    operator: Equals
-                    value: false
-
+        message: Pods and containers must run as non-root.
+        # Accept either a Pod-level setting with no container override, or an
+        # explicit true value on every container and init container.
+        anyPattern:
+          - spec:
+              securityContext:
+                runAsNonRoot: true
+              containers:
+                - =(securityContext):
+                    =(runAsNonRoot): true
+              =(initContainers):
+                - =(securityContext):
+                    =(runAsNonRoot): true
+          - spec:
+              containers:
+                - securityContext:
+                    runAsNonRoot: true
+              =(initContainers):
+                - securityContext:
+                    runAsNonRoot: true