fix kyverno boolean and resource validation

policies/kyverno/require-non-root.yaml

@@ -23,20 +23,23 @@ spec:
                 matchLabels:
                   security-baseline/open: "true"
       validate:
-        message: Containers must explicitly set runAsNonRoot=true.
-        foreach:
-          - list: request.object.spec.containers[]
-            deny:
-              conditions:
-                any:
-                  - key: "{{ element.securityContext.runAsNonRoot || false }}"
-                    operator: Equals
-                    value: false
-          - list: request.object.spec.initContainers[]
-            deny:
-              conditions:
-                any:
-                  - key: "{{ element.securityContext.runAsNonRoot || false }}"
-                    operator: Equals
-                    value: false
-
+        message: Pods and containers must run as non-root.
+        # Accept either a Pod-level setting with no container override, or an
+        # explicit true value on every container and init container.
+        anyPattern:
+          - spec:
+              securityContext:
+                runAsNonRoot: true
+              containers:
+                - =(securityContext):
+                    =(runAsNonRoot): true
+              =(initContainers):
+                - =(securityContext):
+                    =(runAsNonRoot): true
+          - spec:
+              containers:
+                - securityContext:
+                    runAsNonRoot: true
+              =(initContainers):
+                - securityContext:
+                    runAsNonRoot: true

policies/kyverno/require-resource-limits.yaml

@@ -27,23 +27,14 @@ spec:
         message: Every container must define CPU and memory limits.
         foreach:
           - list: request.object.spec.containers[]
-            deny:
-              conditions:
-                any:
-                  - key: "{{ element.resources.limits.cpu || '' }}"
-                    operator: Equals
-                    value: ""
-                  - key: "{{ element.resources.limits.memory || '' }}"
-                    operator: Equals
-                    value: ""
+            pattern:
+              resources:
+                limits:
+                  cpu: "?*"
+                  memory: "?*"
           - list: request.object.spec.initContainers[]
-            deny:
-              conditions:
-                any:
-                  - key: "{{ element.resources.limits.cpu || '' }}"
-                    operator: Equals
-                    value: ""
-                  - key: "{{ element.resources.limits.memory || '' }}"
-                    operator: Equals
-                    value: ""
-
+            pattern:
+              resources:
+                limits:
+                  cpu: "?*"
+                  memory: "?*"