fix kyverno boolean and resource validation

policies/kyverno/require-non-root.yaml

@@ -23,20 +23,23 @@ spec:
                 matchLabels:
                   security-baseline/open: "true"
       validate:
-        message: Containers must explicitly set runAsNonRoot=true.
+        message: Pods and containers must run as non-root.
-        foreach:
+        # Accept either a Pod-level setting with no container override, or an
-          - list: request.object.spec.containers[]
+        # explicit true value on every container and init container.
-            deny:
+        anyPattern:
-              conditions:
+          - spec:
-                any:
+              securityContext:
-                  - key: "{{ element.securityContext.runAsNonRoot || false }}"
+                runAsNonRoot: true
-                    operator: Equals
+              containers:
-                    value: false
+                - =(securityContext):
-          - list: request.object.spec.initContainers[]
+                    =(runAsNonRoot): true
-            deny:
+              =(initContainers):
-              conditions:
+                - =(securityContext):
-                any:
+                    =(runAsNonRoot): true
-                  - key: "{{ element.securityContext.runAsNonRoot || false }}"
+          - spec:
-                    operator: Equals
+              containers:
-                    value: false
+                - securityContext:
-
+                    runAsNonRoot: true
+              =(initContainers):
+                - securityContext:
+                    runAsNonRoot: true

policies/kyverno/require-resource-limits.yaml

@@ -27,23 +27,14 @@ spec:
         message: Every container must define CPU and memory limits.
         foreach:
           - list: request.object.spec.containers[]
-            deny:
+            pattern:
-              conditions:
+              resources:
-                any:
+                limits:
-                  - key: "{{ element.resources.limits.cpu || '' }}"
+                  cpu: "?*"
-                    operator: Equals
+                  memory: "?*"
-                    value: ""
-                  - key: "{{ element.resources.limits.memory || '' }}"
-                    operator: Equals
-                    value: ""
           - list: request.object.spec.initContainers[]
-            deny:
+            pattern:
-              conditions:
+              resources:
-                any:
+                limits:
-                  - key: "{{ element.resources.limits.cpu || '' }}"
+                  cpu: "?*"
-                    operator: Equals
+                  memory: "?*"
-                    value: ""
-                  - key: "{{ element.resources.limits.memory || '' }}"
-                    operator: Equals
-                    value: ""
-