apiVersion : kyverno.io/v1
kind : ClusterPolicy
metadata :
  name : check-non-root
spec :
  rules:
    - name: check-non-root
      match:
        resources:
          kinds:
          - Deployment
          - StatefuleSet
          - DaemonSet
      validate:
        message: "Root user is not allowed"
        pattern:
          spec:
            template:
              spec:
                securityContext:
                  runAsNonRoot: true
