Certificate max duration 100 days

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4  name: cert-manager-limit-duration
 5  annotations:
 6    policies.kyverno.io/title: Certificate max duration 100 days
 7    policies.kyverno.io/category: Cert-Manager
 8    policies.kyverno.io/severity: medium
 9    policies.kyverno.io/minversion: 1.3.6
10    policies.kyverno.io/subject: Certificate
11    policies.kyverno.io/description: >-
12            Kubernetes managed non-letsencrypt certificates have to be renewed in every 100 days.
13spec:
14  validationFailureAction: audit
15  background: false
16  rules:
17  - name: certificate-duration-max-100days 
18    match:
19      resources:
20        kinds:
21        - Certificate
22    preconditions:
23      all:
24      - key: "{{ contains(request.object.spec.issuerRef.name, 'letsencrypt') }}"
25        operator: Equals
26        value: False
27      - key: "{{ request.object.spec.duration }}"
28        operator: NotEquals
29        value: ""
30    validate:
31      message: "certificate duration must be < than 2400h (100 days)"
32      deny:
33        conditions:
34        - key: "{{ max( [ to_number(regex_replace_all('h.*',request.object.spec.duration,'')), to_number('2400') ] ) }}"
35          operator: NotEquals
36          value: 2400
37