add anchors for omitempty tag

samples/best_practices/disallow_privileged.yaml

@@ -10,6 +10,7 @@ metadata:
       With `securityContext.allowPrivilegeEscalation` enabled, a process can 
       gain privileges from its parent. 
 spec:
+  validationFailureAction: enforce
   rules:
   - name: validate-privileged
     match:
@@ -18,15 +19,13 @@ spec:
         - Pod
     validate:
       message: "Privileged mode is not allowed. Set privileged to false"
-      anyPattern:
-      - spec:
-          securityContext:
-            privileged: false
-      - spec:
+      pattern:
+        spec:
           containers:
-          - name: "*"
-            securityContext:
-              privileged: false
+          - =(securityContext):
+              # https://github.com/kubernetes/api/blob/7dc09db16fb8ff2eee16c65dc066c85ab3abb7ce/core/v1/types.go#L5707-L5711
+              # k8s default to false
+              =(privileged): false
   - name: validate-allowPrivilegeEscalation
     match:
       resources:
@@ -34,13 +33,10 @@ spec:
         - Pod
     validate:
       message: "Privileged mode is not allowed. Set allowPrivilegeEscalation to false"
-      anyPattern:
-      - spec:
-          securityContext:
-            allowPrivilegeEscalation: false
-      - spec:
+      pattern:
+        spec:
           containers:
-          - name: "*"
-            securityContext:
+          - securityContext:
+              # https://github.com/kubernetes/api/blob/7dc09db16fb8ff2eee16c65dc066c85ab3abb7ce/core/v1/types.go#L5754
               allowPrivilegeEscalation: false
 

samples/best_practices/disallow_root_user.yaml

@@ -20,9 +20,10 @@ spec:
       anyPattern:
       - spec:
           securityContext:
+            # https://github.com/kubernetes/api/blob/7dc09db16fb8ff2eee16c65dc066c85ab3abb7ce/core/v1/types.go#L3165
             runAsNonRoot: true
       - spec:
           containers:
-          - name: "*"
-            securityContext:
+          - securityContext:
+              # https://github.com/kubernetes/api/blob/7dc09db16fb8ff2eee16c65dc066c85ab3abb7ce/core/v1/types.go#L5742
               runAsNonRoot: true