add Kyverno and Falco security test workloads

test-workloads/blocked/default-namespace-pod.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: blocked-default-namespace
+  namespace: default
+spec:
+  restartPolicy: Never
+  securityContext:
+    runAsNonRoot: true
+  containers:
+    - name: app
+      image: docker.io/library/busybox:1.36
+      command: ["sleep", "3600"]
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+      resources:
+        limits:
+          cpu: 100m
+          memory: 64Mi

test-workloads/blocked/host-network-pod.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: blocked-host-network
+  namespace: security-baseline
+spec:
+  hostNetwork: true
+  hostPID: true
+  hostIPC: true
+  restartPolicy: Never
+  securityContext:
+    runAsNonRoot: true
+  containers:
+    - name: app
+      image: docker.io/library/busybox:1.36
+      command: ["sleep", "3600"]
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+      resources:
+        limits:
+          cpu: 100m
+          memory: 64Mi

test-workloads/blocked/privileged-pod.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: blocked-privileged
+  namespace: security-baseline
+spec:
+  restartPolicy: Never
+  securityContext:
+    runAsNonRoot: true
+  containers:
+    - name: app
+      image: docker.io/library/busybox:1.36
+      command: ["sleep", "3600"]
+      securityContext:
+        privileged: true
+        runAsNonRoot: true
+        runAsUser: 1000
+      resources:
+        limits:
+          cpu: 100m
+          memory: 64Mi

test-workloads/blocked/root-container.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: blocked-root
+  namespace: security-baseline
+spec:
+  restartPolicy: Never
+  containers:
+    - name: app
+      image: docker.io/library/busybox:1.36
+      command: ["sleep", "3600"]
+      securityContext:
+        runAsNonRoot: false
+        runAsUser: 0
+      resources:
+        limits:
+          cpu: 100m
+          memory: 64Mi

test-workloads/blocked/unapproved-registry-pod.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: blocked-unapproved-registry
+  namespace: security-baseline
+spec:
+  restartPolicy: Never
+  securityContext:
+    runAsNonRoot: true
+  containers:
+    - name: app
+      image: registry.example.com/security-test:1.0
+      command: ["sleep", "3600"]
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+      resources:
+        limits:
+          cpu: 100m
+          memory: 64Mi