---
# This test will always pass unless the feature gate `ProcMountType` is enabled. 
# Any values set for `procMount` will be mutated by Kubernetes to be read as `Default` 
# upon submission. Therefore, without the feature gate enabled this manifest will always 
# validate to true.
apiVersion: v1
kind: Pod
metadata:
  name: proc-mount
  labels:
    pod-security-standards/policy: "Baseline"
    pod-security-standards/control: "Proc_Mount_Type"  
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000       
  containers: 
  - name: proc-mount
    image: kubernetes/pause
    securityContext:
      procMount: Unmasked