Certificate max duration 100 days

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4  name: cert-manager-limit-duration
 5  annotations:
 6    policies.kyverno.io/title: Certificate max duration 100 days
 7    policies.kyverno.io/category: Cert-Manager
 8    policies.kyverno.io/severity: medium
 9    policies.kyverno.io/minversion: 1.6.0
10    policies.kyverno.io/subject: Certificate
11    policies.kyverno.io/description: >-
12      Kubernetes managed non-letsencrypt certificates have to be renewed in every 100 days.      
13spec:
14  validationFailureAction: audit
15  background: false
16  rules:
17  - name: certificate-duration-max-100days 
18    match:
19      any:
20      - resources:
21          kinds:
22          - Certificate
23    preconditions:
24      all:
25      - key: "{{ contains(request.object.spec.issuerRef.name, 'letsencrypt') }}"
26        operator: Equals
27        value: False
28      - key: "{{ request.object.spec.duration }}"
29        operator: NotEquals
30        value: ""
31    validate:
32      message: "certificate duration must be < than 2400h (100 days)"
33      deny:
34        conditions:
35          all:
36          - key: "{{ max( [ to_number(regex_replace_all('h.*',request.object.spec.duration,'')), to_number('2400') ] ) }}"
37            operator: NotEquals
38            value: 2400