kyverno.yaml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: psp-selinux
spec:
  validationFailureAction: Enforce
  rules:
    - name: seLinux
      match:
        resources:
          kinds:
            - Pod
      validate:
        message: >-
          SELinux options are limited
        anyPattern:
          - spec:
              securityContext:
                seLinuxOptions:
                    level: s0:c123,c456
                    role: object_r
                    type: svirt_sandbox_file_t
                    user: system_u
          - spec:
              =(securityContext):
                =(seLinuxOptions):
                  level: s0:c123,c456
                  role: object_r
                  type: svirt_sandbox_file_t
                  user: system_u
              containers:
                - securityContext:
                    seLinuxOptions:
                      level: s0:c123,c456
                      role: object_r
                      type: svirt_sandbox_file_t
                      user: system_u
              =(initContainers):
                - securityContext:
                    seLinuxOptions:
                      level: s0:c123,c456
                      role: object_r
                      type: svirt_sandbox_file_t
                      user: system_u