kyverno.yaml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: psp-privileged-container
spec:
  validationFailureAction: Enforce
  rules:
    - name: privileged-containers
      match:
        resources:
          kinds:
            - Pod
      validate:
        message: >-
          Privileged mode is disallowed. The fields spec.securityContext.privileged,
          spec.containers[*].securityContext.privileged
          and spec.initContainers[*].securityContext.privileged and 
          spec.ephemeralContainers[*].securityContext.privileged must not be set to true.
        pattern:
          spec:
            =(initContainers):
              - =(securityContext):
                  =(privileged): "false"
            =(ephemeralContainers):
              - =(securityContext):
                  =(privileged): "false"
            containers:
              - =(securityContext):
                  =(privileged): "false"