apiVersion: v1
policies:
  - name: Security
    isDefault: true
    rules:
      - identifier: WORKLOAD_INVALID_CONTAINER_CAPABILITIES_VALUE
        messageOnFailure: Insecure and dangerous container capabilities values are not allowed by the organization.
customRules:
  - identifier: WORKLOAD_INVALID_CONTAINER_CAPABILITIES_VALUE  
    name: Deny dangerous container capabilities, organization follows hardened pod security standards ref:(https://kubernetes.io/docs/concepts/security/pod-security-standards/)
    defaultMessageOnFailure: Insecure and dangerous container capabilities values are not allowed by the organization.
    schema:
      definitions:
        Capabilities:
          properties:
            spec:
              properties:
                containers:
                  type: array
                  items:
                    properties:
                      securityContext:
                        properties:
                          capabilities:
                            properties:
                              add:
                                type: array
                                items:
                                  type: string
                                  not:
                                    enum:
                                      - ALL
                                      - SYS_ADMIN
                                      - NET_ADMIN
                                      - CHOWN
                                      - DAC_OVERRIDE
                                      - FSETID
                                      - FOWNER
                                      - MKNOD
                                      - NET_RAW
                                      - SETGID
                                      - SETUID
                                      - SETFCAP
                                      - SETPCAP
                                      - SYS_CHROOT
                                      - KILL
                                      - AUDIT_WRITE
      allOf:
        - $ref: "#/definitions/Capabilities"
      additionalProperties:
        $ref: "#"
      items:
        $ref: "#"