apiVersion: v1
kind: Namespace
metadata:
  name: cks-workload
---
apiVersion: v1
kind: Pod
metadata:
  name: inventory
  namespace: cks-workload
  labels:
    app: inventory
spec:
  securityContext:
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: inventory
      image: busybox:1.37
      command: ["sh", "-c", "id; sleep 3600"]
      securityContext:
        runAsUser: 1000
        runAsNonRoot: true
        allowPrivilegeEscalation: false
        capabilities:
          drop: ["ALL"]