apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: validate-namespace-tenant-a
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
      - apiGroups: [""]
        apiVersions: ["v1"]
        operations: ["CREATE", "UPDATE"]
        resources: ["pods"]
  validations:
    - expression: >-
        (!has(object.spec.hostNetwork) || object.spec.hostNetwork == false) &&
        (!has(object.spec.hostPID) || object.spec.hostPID == false) &&
        (!has(object.spec.hostIPC) || object.spec.hostIPC == false) &&
        (!has(object.spec.volumes) || object.spec.volumes.all(v, !has(v.hostPath))) &&
        object.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged == false)
      message: host namespaces, hostPath volumes, and privileged containers are not allowed
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: validate-namespace-tenant-a
spec:
  policyName: validate-namespace-tenant-a
  validationActions: [Deny]
  matchResources:
    namespaceSelector:
      matchLabels:
        training.cks/lesson: tenant-a