apiVersion: apps/v1
kind: Deployment
metadata:
  name: deployment
  namespace: capabilities-some-allowed
spec:
  selector:
    matchLabels:
      name: deployment
  template:
    metadata:
      labels:
        name: deployment
        audit.kubernetes.io/pod.allow-capability-chown: "SomeReason"
        audit.kubernetes.io/pod.allow-capability-sys-time: "SomeReason"
    spec:
      containers:
        - name: container
          image: scratch
          securityContext:
            capabilities:
              add:
                - SYS_TIME
                - SYS_MODULE
                - CHOWN
              drop:
                - ALL
