apiVersion: v1
kind: Pod
metadata:
  name: compliant-workload
  namespace: security-baseline
  labels:
    app.kubernetes.io/name: compliant-workload
    security-baseline/test: admission-pass
spec:
  restartPolicy: Never
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: app
      image: docker.io/library/busybox:1.36
      command: ["sh", "-c", "echo compliant-workload-ready; sleep 3600"]
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        allowPrivilegeEscalation: false
        capabilities:
          drop: [ALL]
      resources:
        requests:
          cpu: 10m
          memory: 16Mi
        limits:
          cpu: 100m
          memory: 64Mi