add samples/best_practices/deny_runasrootuser.yaml

samples/best_practices/policy_validate_container_disallow_priviledgedprivelegesecalation.yaml

@@ -0,0 +1,26 @@
+apiVersion: kyverno.io/v1alpha1
+kind: ClusterPolicy
+metadata:
+  name: validate-deny-privileged-disallowpriviligedescalation
+spec:
+  validationFailureAction: "audit"
+  rules:
+  - name: deny-privileged-disallowpriviligedescalation
+    exclude:
+    match:
+      resources:
+        kinds:
+        - Pod
+    validate:
+      message: "Privileged mode is not allowed. Set allowPrivilegeEscalation and privileged to false"
+      anyPattern:
+      - spec:
+          securityContext:
+            allowPrivilegeEscalation: false
+            privileged: false
+      - spec:
+          containers:
+          - name: "*"
+            securityContext:
+              allowPrivilegeEscalation: false
+              privileged: false    

test/scenarios/test/scenario_validate_deny_runasrootuser.yaml

@@ -1,7 +1,7 @@
 # file path relative to project root
 input:
-  policy: examples/best_practices/policy_validate_deny_runasrootuser.yaml
+  policy: samples/best_practices/deny_runasrootuser.yaml
-  resource: examples/best_practices/resources/resource_validate_deny_runasrootuser.yaml
+  resource: test/manifest/resource_validate_deny_runasrootuser.yaml
 expected:
   validation:
     policyresponse: