fix: fix seccomp rule logic (#951)

pkg/defaultRules/defaultRules.yaml

@@ -3352,57 +3352,81 @@ rules:
     impact: Using the default seccomp profile may allow risky privileges for workloads
     schema:
       definitions:
-        podAnnotationsPattern:
+        annotationsPattern:
+          properties:
+            metadata:
+              properties:
+                annotations:
+                  properties:
+                    seccomp.security.alpha.kubernetes.io/pod:
+                      enum:
+                        - docker/default
+                        - runtime/default
+                  required:
+                    - seccomp.security.alpha.kubernetes.io/pod
+              required:
+                - annotations
+          required:
+            - metadata
+        seccompProfilePattern:
           if:
             properties:
               kind:
                 enum:
                   - Pod
-            required:
-              - kind
           then:
+            required:
+              - spec
             properties:
-              metadata:
+              spec:
+                required:
+                  - securityContext
                 properties:
-                  annotations:
-                    properties:
-                      seccomp.security.alpha.kubernetes.io/pod:
-                        enum:
-                          - docker/default
-                          - runtime/default
+                  securityContext:
                     required:
-                      - seccomp.security.alpha.kubernetes.io/pod
-                required:
-                  - annotations
+                      - seccompProfile
+                    properties:
+                      seccompProfile:
+                        required:
+                          - type
+                        properties:
+                          type:
+                            enum:
+                              - RuntimeDefault
+                              - DockerDefault
+          else:
             required:
-              - metadata
-        templateAnnotationsPattern:
-          properties:
-            spec:
-              properties:
-                template:
-                  properties:
-                    metadata:
-                      properties:
-                        annotations:
-                          properties:
-                            seccomp.security.alpha.kubernetes.io/pod:
-                              enum:
-                                - docker/default
-                                - runtime/default
-                          required:
-                            - seccomp.security.alpha.kubernetes.io/pod
-                      required:
-                        - annotations
-                  required:
-                    - metadata
-      allOf:
-        - $ref: "#/definitions/podAnnotationsPattern"
-        - $ref: "#/definitions/templateAnnotationsPattern"
-      additionalProperties:
-        $ref: "#"
-      items:
-        $ref: "#"
+              - spec
+            properties:
+              spec:
+                required:
+                  - template
+                properties:
+                  template:
+                    required:
+                      - spec
+                    properties:
+                      spec:
+                        required:
+                          - securityContext
+                        properties:
+                          securityContext:
+                            required:
+                              - seccompProfile
+                            properties:
+                              seccompProfile:
+                                required:
+                                  - type
+                                properties:
+                                  type:
+                                    enum:
+                                      - RuntimeDefault
+                                      - DockerDefault
+      if: *standardKinds
+      then:
+        anyOf:
+          - $ref: "#/definitions/annotationsPattern"
+          - $ref: "#/definitions/seccompProfilePattern"
   - id: 100
     name: Ensure containers and pods have a configured security context
     uniqueName: CIS_MISSING_KEY_SECURITYCONTEXT