apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: hello
spec:
  jobTemplate:
    spec:
      template:
        metadata:
          annotations:
            seccomp.security.alpha.kubernetes.io/pod: runtime/default
            container.apparmor.security.beta.kubernetes.io/hello: runtime/default
        spec:
          automountServiceAccountToken: false
          containers:
          - args:
            - /bin/sh
            - -c
            - date; echo Hello from the Kubernetes cluster
            image: busybox
            name: hello
            resources: {}
            securityContext:
              allowPrivilegeEscalation: false
              capabilities:
                drop:
                - AUDIT_WRITE
                - CHOWN
                - DAC_OVERRIDE
                - FOWNER
                - FSETID
                - KILL
                - MKNOD
                - NET_BIND_SERVICE
                - NET_RAW
                - SETFCAP
                - SETGID
                - SETPCAP
                - SETUID
                - SYS_CHROOT
              privileged: false
              readOnlyRootFilesystem: true
              runAsNonRoot: true
          restartPolicy: OnFailure
  schedule: '*/1 * * * *'
