apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: dynatrace-oneagent-unprivileged
  annotations:
    apparmor.security.beta.kubernetes.io/allowedProfileNames: "unconfined"
    seccomp.security.alpha.kubernetes.io/allowedProfileNames: "*"
spec:
  privileged: false
  allowPrivilegeEscalation: true
  allowedCapabilities:
    - CHOWN
    - DAC_OVERRIDE
    - DAC_READ_SEARCH
    - FOWNER
    - FSETID
    - KILL
    - NET_ADMIN
    - NET_RAW
    - SETFCAP
    - SETGID
    - SETUID
    - SYS_ADMIN
    - SYS_CHROOT
    - SYS_PTRACE
    - SYS_RESOURCE
  requiredDropCapabilities:
    - ALL
  volumes:
    - "*"
  hostNetwork: true
  hostIPC: true
  hostPID: true
  hostPorts:
    - min: 0
      max: 65535
  runAsUser:
    rule: "RunAsAny"
  seLinux:
    rule: "RunAsAny"
  supplementalGroups:
    rule: "RunAsAny"
  fsGroup:
    rule: "RunAsAny"
