From 1b0848c22434e89504a4c45e0d16c0bf2dd9b725 Mon Sep 17 00:00:00 2001
From: Keith Jackson <keithallenjackson@gmail.com>
Date: Tue, 25 Aug 2026 16:00:42 -0500
Subject: [PATCH] fix(kyverno): correct default-deny-shape to require both
 Ingress+Egress via deny.conditions (scalar-array pattern was inverted)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../policies/validate-default-deny-shape.yaml      | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/platform/kyverno/policies/validate-default-deny-shape.yaml b/platform/kyverno/policies/validate-default-deny-shape.yaml
index 8c693fa..e14c6ce 100644
--- a/platform/kyverno/policies/validate-default-deny-shape.yaml
+++ b/platform/kyverno/policies/validate-default-deny-shape.yaml
@@ -36,8 +36,12 @@ spec:
         message: >-
           A default-deny baseline NetworkPolicy must set spec.policyTypes to include
           BOTH Ingress and Egress (R-NET-01, docs/03).
-        pattern:
-          spec:
-            policyTypes:
-              - Ingress
-              - Egress
+        deny:
+          conditions:
+            any:
+              - key: Ingress
+                operator: AnyNotIn
+                value: "{{ request.object.spec.policyTypes || `[]` }}"
+              - key: Egress
+                operator: AnyNotIn
+                value: "{{ request.object.spec.policyTypes || `[]` }}"