"Require runAsNonRoot" policy with "initContainers: null"

[jplitza]

The sample policy Require runAsNonRoot fails with the following Pod spec:

apiVersion: v1
kind: Pod
metadata:
  name: null-initcontainers
spec:
  securityContext:
    runAsNonRoot: true
  containers:
  - image: alpine:latest
  initContainers:

Without the last line (which is equivalent to initContainers: null), the policy succeeds.

This situation is common with Helm charts, where list keys are always templated, followed by a loop for the items. It is valid according to the Kubernetes schemas, too.

[realshuting]

Not sure if this is something we can "fix" in Kyverno. With =(initContainers): declaration, it means if the initContainers exists, check the following XYZ.

An alternative is to use PSS policies in CEL:

https://kyverno.io/policies/?policytypes=Pod%2520Security%2520Standards%2520%28Baseline%29%2520in%2520CEL%2BPod%2520Security%2520Standards%2520%28Restricted%29%2520in%2520CEL