Apply ClusterPolicy for existing Pods/Deployments

[Jedi-5]

Usecase:

1. https://playground.kyverno.io
2. Resources
   `apiVersion: v1
   kind: Pod
   metadata:
   labels:
   run: nginx
   name: nginx
   namespace: default
   spec:
   securityContext:
   runAsUser: 1000
   containers:
   • image: nginx
     name: nginx
     resources: {}`
3. Policies
   `apiVersion: kyverno.io/v1
   kind: ClusterPolicy
   metadata:
   name: apply-pss-restricted-profile
   annotations:
   policies.kyverno.io/title: Apply PSS Restricted Profile
   policies.kyverno.io/category: Other, PSP Migration
   kyverno.io/kyverno-version: 1.6.2
   kyverno.io/kubernetes-version: "1.23"
   policies.kyverno.io/subject: Pod
   policies.kyverno.io/description: >-
   Pod Security Standards define the fields and their options which
   are allowable for Pods to achieve certain security best practices. While
   these are typically validation policies, workloads will either be accepted or
   rejected based upon what has already been defined. It is also possible to mutate
   incoming Pods to achieve the desired PSS level rather than reject. This policy
   sets all the fields necessary to pass the PSS Restricted profile. Note that it does
   not attempt to remove non-compliant volumes and volumeMounts. Additional policies
   may be employed for this purpose.
   spec:
   mutateExistingOnPolicyUpdate: true
   rules:

• name: add-pss-fields
  match:
  any:
  • resources:
    kinds:
    • Pod
      mutate:
      targets:
  • apiVersion: v1
    kind: Pod
    name: nginx
    namespace: default
    patchStrategicMerge:
    spec:
    securityContext:
    seccompProfile:
    type: RuntimeDefault
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
    containers:
    • (name): "?*"
      securityContext:
      privileged: false
      capabilities:
      drop:
      - ALL
      allowPrivilegeEscalation: false
      `

Running above not applying the patch, Please suggest solution for above issue.