apiVersion: v1
kind: ConfigMap
metadata:
  name: psa-pod-security-admission-config
  namespace: kube-system
data:
  config.yaml: |
    - name: baseline
      nonCoreVolumeTypes: true
      allowPrivilegeEscalation: true
      rootGroups: true
      seccomp: true
      forceRunAsNonRoot: true
    - name: traceable
      nonCoreVolumeTypes: true
      allowPrivilegeEscalation: true
      rootGroups: true
      seccomp: true
      forceRunAsNonRoot: true
      allowedHostPaths:
      - pathPrefix: /sys/kernel/tracing
    - name: restricted
