kyverno/examples/best_practices/policy_validate_sysctl_configs.yaml

apiVersion: kyverno.io/v1alpha1
kind: ClusterPolicy
metadata:
  name: validate-allow-portrange-with-sysctl
spec:
  validationFailureAction: "audit"
  rules:
  - name: allow-portrange-with-sysctl
    match:
      resources:
        kinds:
        - Pod
    validate:
      message: "Allowed port range is from 1024 to 65535"
      pattern:
        spec:
          securityContext:
            sysctls: 
            - name: net.ipv4.ip_local_port_range
              value: "1024 65535"