# Compliant pod for the six Enforce baseline policies.
apiVersion: v1
kind: Pod
metadata:
  name: good-pod
  namespace: grafana
  labels:
    app.kubernetes.io/name: smoke
    app.kubernetes.io/instance: smoke
spec:
  containers:
    - name: app
      image: busybox:1.36
      resources:
        requests:
          cpu: 10m
          memory: 16Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
            - ALL
---
apiVersion: v1
kind: Pod
metadata:
  name: debug-ephemeral-container
  namespace: grafana
  labels:
    app.kubernetes.io/name: smoke
    app.kubernetes.io/instance: smoke
spec:
  containers:
    - name: app
      image: busybox:1.36
      resources:
        requests:
          cpu: 10m
          memory: 16Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
            - ALL
  ephemeralContainers:
    - name: debug
      image: busybox:1.36
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
            - ALL
---
# Missing standard app labels.
apiVersion: v1
kind: Pod
metadata:
  name: bad-labels
  namespace: grafana
spec:
  containers:
    - name: app
      image: busybox:1.36
      resources:
        requests:
          cpu: 10m
          memory: 16Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
            - ALL
---
# Uses the :latest tag.
apiVersion: v1
kind: Pod
metadata:
  name: bad-latest
  namespace: grafana
  labels:
    app.kubernetes.io/name: smoke
    app.kubernetes.io/instance: smoke
spec:
  containers:
    - name: app
      image: busybox:latest
      resources:
        requests:
          cpu: 10m
          memory: 16Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
            - ALL
---
# privileged: true
apiVersion: v1
kind: Pod
metadata:
  name: bad-privileged
  namespace: grafana
  labels:
    app.kubernetes.io/name: smoke
    app.kubernetes.io/instance: smoke
spec:
  containers:
    - name: app
      image: busybox:1.36
      resources:
        requests:
          cpu: 10m
          memory: 16Mi
      securityContext:
        privileged: true
        allowPrivilegeEscalation: false
        capabilities:
          drop:
            - ALL
---
# capabilities.drop does not include ALL.
apiVersion: v1
kind: Pod
metadata:
  name: bad-caps
  namespace: grafana
  labels:
    app.kubernetes.io/name: smoke
    app.kubernetes.io/instance: smoke
spec:
  containers:
    - name: app
      image: busybox:1.36
      resources:
        requests:
          cpu: 10m
          memory: 16Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
            - NET_RAW
---
# allowPrivilegeEscalation unset.
apiVersion: v1
kind: Pod
metadata:
  name: bad-ape
  namespace: grafana
  labels:
    app.kubernetes.io/name: smoke
    app.kubernetes.io/instance: smoke
spec:
  containers:
    - name: app
      image: busybox:1.36
      resources:
        requests:
          cpu: 10m
          memory: 16Mi
      securityContext:
        capabilities:
          drop:
            - ALL
---
# Missing CPU/memory requests.
apiVersion: v1
kind: Pod
metadata:
  name: bad-requests
  namespace: grafana
  labels:
    app.kubernetes.io/name: smoke
    app.kubernetes.io/instance: smoke
spec:
  containers:
    - name: app
      image: busybox:1.36
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
            - ALL
---
# Control-plane namespace: policies exclude kube-system (expect skip).
apiVersion: v1
kind: Pod
metadata:
  name: excluded-ns
  namespace: kube-system
spec:
  containers:
    - name: app
      image: busybox:latest