Same function to achieve as psa+debugging profile

[tonyaw]

opagk is one option for our product to replace psp, and following template shall be used:
https://github.com/open-policy-agent/gatekeeper-library/tree/master/library/pod-security-policy#pod-security-policies

By using template here, my understanding is there is no way to treat ephemeral container in a special way.
I mean I can't start a "privilleged" ephemeral container in a "restricted" pod since ConstraintTemplate here treats ephemeral container just same as normal container:
https://github.com/open-policy-agent/gatekeeper-library/blob/master/library/pod-security-policy/capabilities/template.yaml

Is it possible to provide some way to create a "privilleged" ephemeral container in a "restricted" pod just as "debugging profile" plans to do for psa?
kubernetes/kubectl#1108

Thanks in advance!

[tonyaw]

exemptImages shall be used.
Thanks!