apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-privileged
  annotations:
    policies.kyverno.io/title: Disallow privileged containers
    policies.kyverno.io/category: Pod Security Standards
    policies.kyverno.io/severity: high
    # CIS 5.2.2: minimize admission of privileged containers.
    policies.kyverno.io/cis-control: "5.2.2"
spec:
  validationFailureAction: Enforce
  background: false
  failurePolicy: Fail
  rules:
    - name: privileged-containers
      match:
        any:
          - resources:
              kinds:
                - Pod
              namespaceSelector:
                matchLabels:
                  security-baseline/open: "true"
      validate:
        message: Privileged containers are not allowed in security-baseline namespaces.
        foreach:
          - list: request.object.spec.containers[]
            deny:
              conditions:
                any:
                  - key: "{{ element.securityContext.privileged || false }}"
                    operator: Equals
                    value: true
          - list: request.object.spec.initContainers[]
            deny:
              conditions:
                any:
                  - key: "{{ element.securityContext.privileged || false }}"
                    operator: Equals
                    value: true