apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-non-root
  annotations:
    policies.kyverno.io/title: Require non-root containers
    policies.kyverno.io/category: Pod Security Standards
    policies.kyverno.io/severity: high
    # CIS 5.2.7: minimize admission of root containers.
    policies.kyverno.io/cis-control: "5.2.7"
spec:
  validationFailureAction: Enforce
  background: false
  failurePolicy: Fail
  rules:
    - name: containers-run-as-non-root
      match:
        any:
          - resources:
              kinds:
                - Pod
              namespaceSelector:
                matchLabels:
                  security-baseline/open: "true"
      validate:
        message: Pods and containers must run as non-root.
        # Accept either a Pod-level setting with no container override, or an
        # explicit true value on every container and init container.
        anyPattern:
          - spec:
              securityContext:
                runAsNonRoot: true
              containers:
                - =(securityContext):
                    =(runAsNonRoot): true
              =(initContainers):
                - =(securityContext):
                    =(runAsNonRoot): true
          - spec:
              containers:
                - securityContext:
                    runAsNonRoot: true
              =(initContainers):
                - securityContext:
                    runAsNonRoot: true