apiVersion: v1
kind: Pod
metadata:
  name: cap-dac-read-search-container
  namespace: metarget
spec:
  containers:
  - name: ubuntu
    image: ubuntu:latest
    imagePullPolicy: IfNotPresent
    securityContext:
      capabilities:
        add: ["DAC_READ_SEARCH"]
    # Just spin & wait forever
    command: [ "/bin/bash", "-c", "--" ]
    args: [ "while true; do sleep 30; done;" ]
