apiVersion: v1
kind: Pod
metadata:
  name: capability2
  annotations:
    test.pod-security.cybozu.com/message: "denied the request: spec.containers[0].securityContext.capabilities.add[0]: Forbidden: Adding capability NET_ADMIN is not allowed"
spec:
  securityContext:
    runAsNonRoot: true
  containers:
    - name: ubuntu
      image: quay.io/cybozu/ubuntu
      securityContext:
        capabilities:
          add:
            - NET_ADMIN
