apiVersion: apps/v1
kind: Deployment
metadata:
  name: deployment
  namespace: capabilities-some-allowed-multi-containers-mix-labels
spec:
  selector:
    matchLabels:
      name: deployment
  template:
    metadata:
      labels:
        name: deployment
        audit.kubernetes.io/pod.allow-capability-chown: "SomeReason"
        container.audit.kubernetes.io/container1.allow-capability-chown: "SomeReason"
        container.audit.kubernetes.io/container1.allow-capability-sys-time: "SomeReason"
        container.audit.kubernetes.io/container2.allow-capability-sys-time: "SomeReason"
    spec:
      containers:
        - name: container1
          image: scratch
          securityContext:
            capabilities:
              add:
                - SYS_TIME
                - SYS_MODULE
              drop:
                - AUDIT_WRITE
                - DAC_OVERRIDE
                - FOWNER
                - FSETID
                - KILL
                - MKNOD
                - NET_BIND_SERVICE
                - NET_RAW
                - SETFCAP
                - SETGID
                - SETUID
                - SETPCAP
                - SYS_CHROOT
        - name: container2
          image: scratch
          securityContext:
            capabilities:
              add:
                - SYS_TIME
                - SYS_MODULE
              drop:
                - AUDIT_WRITE
                - DAC_OVERRIDE
                - FOWNER
                - FSETID
                - KILL
                - MKNOD
                - NET_BIND_SERVICE
                - NET_RAW
                - SETFCAP
                - SETGID
                - SETUID
                - SETPCAP
                - SYS_CHROOT
