apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-non-root
  annotations:
    policies.kyverno.io/title: Require non-root containers
    policies.kyverno.io/category: Pod Security Standards
    policies.kyverno.io/severity: high
    # CIS 5.2.7: minimize admission of root containers.
    policies.kyverno.io/cis-control: "5.2.7"
spec:
  validationFailureAction: Enforce
  background: false
  failurePolicy: Fail
  rules:
    - name: containers-run-as-non-root
      match:
        any:
          - resources:
              kinds:
                - Pod
              namespaceSelector:
                matchLabels:
                  security-baseline/open: "true"
      validate:
        message: Containers must explicitly set runAsNonRoot=true.
        foreach:
          - list: request.object.spec.containers[]
            deny:
              conditions:
                any:
                  - key: "{{ element.securityContext.runAsNonRoot || false }}"
                    operator: Equals
                    value: false
          - list: request.object.spec.initContainers[]
            deny:
              conditions:
                any:
                  - key: "{{ element.securityContext.runAsNonRoot || false }}"
                    operator: Equals
                    value: false