May Run as Root

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: initcontainer-run-as-nonroot
  annotations:
    kubeapt.io/uuid: "826c2137-b602-4591-ac39-d2bcd8c826a6"
    security.kubeapt.io/displayName: "May Run as Root"
    security.kubeapt.io/description: "With runAsNonRoot unset, the kubelet never rejects an image whose user is UID 0, so the init container silently runs as root and any compromise gains root file ownership and the full capability set."
    security.kubeapt.io/resource: "InitContainers"
    security.kubeapt.io/severity: "Moderate"
    security.kubeapt.io/remediation: "Set runAsNonRoot to true on every init container, or set it once at pod level and let the init containers inherit it. Fields: spec.initContainers[*].securityContext.runAsNonRoot, spec.securityContext.runAsNonRoot."
    security.kubeapt.io/product: "Kubernetes"
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups:
      - ''
      apiVersions:
      - v1
      operations:
      - CREATE
      - UPDATE
      resources:
      - pods
  variables:
  - name: podNonRootTrue
    expression: |
      has(object.spec.securityContext) && has(object.spec.securityContext.runAsNonRoot) && object.spec.securityContext.runAsNonRoot == true
  validations:
  - expression: |
      !has(object.spec.initContainers) || object.spec.initContainers.all(ic,
        variables.podNonRootTrue
        ? (!has(ic.securityContext) || !has(ic.securityContext.runAsNonRoot) || ic.securityContext.runAsNonRoot == true)
        : (has(ic.securityContext) && has(ic.securityContext.runAsNonRoot) && ic.securityContext.runAsNonRoot == true)
      )
    message: "spec.initContainers[*].securityContext.runAsNonRoot must be set to true, unless the Pod-level spec.securityContext.runAsNonRoot is true\u2014in which case it may be undefined or true.\n"