apiVersion: v1
kind: Namespace
metadata:
  name: tenant-a
  labels:
    training.cks/lesson: tenant-a
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: "validate-namespace-tenant-a"
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups:   [""]
      apiVersions: ["v1"]
      operations:  ["CREATE", "UPDATE"]
      resources:   ["pods"]
  validations:
    - expression: >-
        (!has(object.spec.hostNetwork) || object.spec.hostNetwork==false) &&
        (!has(object.spec.hostPID) || object.spec.hostPID==false) &&
        (!has(object.spec.hostIPC) || object.spec.hostIPC==false) &&
        (!has(object.spec.volumes) || object.spec.volumes.all(v, !has(v.hostPath))) &&
        object.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) ||  c.securityContext.privileged==false)
      message: "host namespaces, hostPath volumes, and privileged containers are not allowed"
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: validate-namespace-tenant-a
spec:
  policyName: validate-namespace-tenant-a
  validationActions: [Deny]
  matchResources:
    namespaceSelector:
      matchLabels:
        training.cks/lesson: tenant-a