kyverno.yaml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: psp-seccomp
spec:
  background: true
  validationFailureAction: Enforce
  rules:
  - name: restrict-seccomp
    match:
      resources:
        kinds:
        - Pod
    validate:
      message: >-
        Use of custom Seccomp profiles is disallowed. The fields
        spec.securityContext.seccompProfile.type,
        spec.containers[*].securityContext.seccompProfile.type,
        spec.initContainers[*].securityContext.seccompProfile.type, and
        spec.ephemeralContainers[*].securityContext.seccompProfile.type
        must not be set, or set to `RuntimeDefault` or `Localhost`.
      pattern:
       spec:
        =(securityContext):
          =(seccompProfile):
            type: "RuntimeDefault | Localhost"      
        containers:
        - =(securityContext):
            =(seccompProfile):
              type: "RuntimeDefault | Localhost"
        =(initContainers):
        - =(securityContext):
            =(seccompProfile):
              type: "RuntimeDefault | Localhost"
        =(ephemeralContainers):
        - =(securityContext):
            =(seccompProfile):
              type: "RuntimeDefault | Localhost"