May Run as Root

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: ephemeralcontainer-run-as-nonroot
  annotations:
    kubeapt.io/uuid: "d2ea2b6d-4d47-4d65-9581-2db116e96f7b"
    security.kubeapt.io/displayName: "May Run as Root"
    security.kubeapt.io/description: "With runAsNonRoot unset, the kubelet never rejects an image whose user is UID 0, so the ephemeral debug container silently runs as root and any compromise gains root file ownership and the full capability set."
    security.kubeapt.io/resource: "EphemeralContainers"
    security.kubeapt.io/severity: "Moderate"
    security.kubeapt.io/remediation: "Set runAsNonRoot to true on every ephemeral container, or set it once at pod level and let the ephemeral containers inherit it. Fields: spec.ephemeralContainers[*].securityContext.runAsNonRoot, spec.securityContext.runAsNonRoot."
    security.kubeapt.io/product: "Kubernetes"
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups:
      - ''
      apiVersions:
      - v1
      operations:
      - CREATE
      - UPDATE
      resources:
      - pods/ephemeralcontainers
  variables:
  - name: podNonRootTrue
    expression: |
      has(object.spec.securityContext) && has(object.spec.securityContext.runAsNonRoot) && object.spec.securityContext.runAsNonRoot == true
  validations:
  - expression: |
      !has(object.spec.ephemeralContainers) || object.spec.ephemeralContainers.all(ec,
        variables.podNonRootTrue
        ? (!has(ec.securityContext) || !has(ec.securityContext.runAsNonRoot) || ec.securityContext.runAsNonRoot == true)
        : (has(ec.securityContext) && has(ec.securityContext.runAsNonRoot) && ec.securityContext.runAsNonRoot == true)
      )
    message: "spec.ephemeralContainers[*].securityContext.runAsNonRoot must be set to true, unless the Pod-level spec.securityContext.runAsNonRoot is true\u2014in which case it may be undefined or true.\n"