apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8sdisallowroot
spec:
  crd:
    spec:
      names:
        kind: K8sDisallowRoot
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8sdisallowroot

        violation[{"msg": msg}] {
          input.review.object.spec.securityContext.runAsNonRoot == false
          msg := "Containers must not run as root. Set spec.securityContext.runAsNonRoot to true."
        }

        violation[{"msg": msg}] {
          some c in input.review.object.spec.containers
          c.securityContext.runAsNonRoot == false
          msg := sprintf("Container %v must not run as root. Set securityContext.runAsNonRoot to true.", [c.name])
        }
---
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sDisallowRoot
metadata:
  name: disallow-root-containers
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
---
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8srequiredlimits
spec:
  crd:
    spec:
      names:
        kind: K8sRequiredLimits
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8srequiredlimits

        violation[{"msg": msg}] {
          some c in input.review.object.spec.containers
          not c.resources.limits.cpu
          msg := sprintf("Container %v must have a CPU limit.", [c.name])
        }

        violation[{"msg": msg}] {
          some c in input.review.object.spec.containers
          not c.resources.limits.memory
          msg := sprintf("Container %v must have a memory limit.", [c.name])
        }
---
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLimits
metadata:
  name: require-resource-limits
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]