apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: security-admission
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiVersions: ["v1"]
      apiGroups: [""]
      operations: ["CREATE","UPDATE"]
      resources: ["pods"]
  validations:
    - expression: "object.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged != true) && (!has(object.spec.initContainers) || object.spec.initContainers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged != true))"
      message: "Privileged regular and init containers are not allowed"
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata: 
  name: security-admission-binding
spec:
  policyName: security-admission
  validationActions: [Deny]
  matchResources:
    namespaceSelector:
      matchLabels:
        cks-training: admission