{
  "properties": {
    "displayName": "Kubernetes cluster pod security restricted standards for Linux-based workloads",
    "policyType": "BuiltIn",
    "description": "This initiative includes the policies for the Kubernetes cluster pod security restricted standards. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc.",
    "metadata": {
      "version": "2.1.1",
      "category": "Kubernetes"
    },
    "parameters": {
      "effect": {
        "type": "String",
        "metadata": {
          "displayName": "Effect",
          "description": "'Audit' allows a non-compliant resource to be created or updated, but flags it as non-compliant. 'Deny' blocks the non-compliant resource creation or update. 'Disabled' turns off the policy."
        },
        "allowedValues": [
          "audit",
          "deny",
          "disabled"
        ],
        "defaultValue": "audit"
      },
      "excludedNamespaces": {
        "type": "Array",
        "metadata": {
          "displayName": "Namespace exclusions",
          "description": "List of Kubernetes namespaces to exclude from policy evaluation."
        },
        "defaultValue": [
          "kube-system",
          "gatekeeper-system",
          "azure-arc"
        ]
      },
      "namespaces": {
        "type": "Array",
        "metadata": {
          "displayName": "Namespace inclusions",
          "description": "List of Kubernetes namespaces to only include in policy evaluation. An empty list means the policy is applied to all resources in all namespaces."
        },
        "defaultValue": []
      }
    },
    "policyDefinitions": [
      {
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/95edb821-ddaf-4404-9732-666045e056b4",
        "policyDefinitionReferenceId": "NoPrivilegedContainers",
        "parameters": {
          "effect": {
            "value": "[parameters('effect')]"
          },
          "excludedNamespaces": {
            "value": "[parameters('excludedNamespaces')]"
          },
          "namespaces": {
            "value": "[parameters('namespaces')]"
          }
        }
      },
      {
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1c6e92c9-99f0-4e55-9cf2-0c234dc48f99",
        "policyDefinitionReferenceId": "NoPrivilegeEscalation",
        "parameters": {
          "effect": {
            "value": "[parameters('effect')]"
          },
          "excludedNamespaces": {
            "value": "[parameters('excludedNamespaces')]"
          },
          "namespaces": {
            "value": "[parameters('namespaces')]"
          }
        }
      },
      {
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/82985f06-dc18-4a48-bc1c-b9f4f0098cfe",
        "policyDefinitionReferenceId": "BlockUsingHostNetwork",
        "parameters": {
          "effect": {
            "value": "[parameters('effect')]"
          },
          "excludedNamespaces": {
            "value": "[parameters('excludedNamespaces')]"
          },
          "namespaces": {
            "value": "[parameters('namespaces')]"
          },
          "allowHostNetwork": {
            "value": false
          },
          "minPort": {
            "value": 0
          },
          "maxPort": {
            "value": 0
          }
        }
      },
      {
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/47a1ee2f-2a2a-4576-bf2a-e0e36709c2b8",
        "policyDefinitionReferenceId": "BlockUsingHostProcessIDAndIPC",
        "parameters": {
          "effect": {
            "value": "[parameters('effect')]"
          },
          "excludedNamespaces": {
            "value": "[parameters('excludedNamespaces')]"
          },
          "namespaces": {
            "value": "[parameters('namespaces')]"
          }
        }
      },
      {
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c26596ff-4d70-4e6a-9a30-c2506bd2f80c",
        "policyDefinitionReferenceId": "ContainerCapabilities",
        "parameters": {
          "effect": {
            "value": "[parameters('effect')]"
          },
          "excludedNamespaces": {
            "value": "[parameters('excludedNamespaces')]"
          },
          "namespaces": {
            "value": "[parameters('namespaces')]"
          },
          "allowedCapabilities": {
            "value": [
              "CHOWN",
              "DAC_OVERRIDE",
              "FSETID",
              "FOWNER",
              "MKNOD",
              "NET_RAW",
              "SETGID",
              "SETUID",
              "SETFCAP",
              "SETPCAP",
              "NET_BIND_SERVICE",
              "SYS_CHROOT",
              "KILL",
              "AUDIT_WRITE"
            ]
          },
          "requiredDropCapabilities": {
            "value": []
          }
        }
      },
      {
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/16697877-1118-4fb1-9b65-9898ec2509ec",
        "policyDefinitionReferenceId": "AllowedVolumeTypes",
        "parameters": {
          "effect": {
            "value": "[parameters('effect')]"
          },
          "excludedNamespaces": {
            "value": "[parameters('excludedNamespaces')]"
          },
          "namespaces": {
            "value": "[parameters('namespaces')]"
          },
          "allowedVolumeTypes": {
            "value": [
              "configMap",
              "emptyDir",
              "projected",
              "secret",
              "downwardAPI",
              "persistentVolumeClaim"
            ]
          }
        }
      },
      {
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f06ddb64-5fa3-4b77-b166-acb36f7f6042",
        "policyDefinitionReferenceId": "AllowedUsersGroups",
        "parameters": {
          "effect": {
            "value": "[parameters('effect')]"
          },
          "excludedNamespaces": {
            "value": "[parameters('excludedNamespaces')]"
          },
          "namespaces": {
            "value": "[parameters('namespaces')]"
          },
          "runAsUserRule": {
            "value": "MustRunAsNonRoot"
          },
          "runAsUserRanges": {
            "value": {
              "ranges": []
            }
          },
          "runAsGroupRule": {
            "value": "MustRunAs"
          },
          "runAsGroupRanges": {
            "value": {
              "ranges": [
                {
                  "min": 1,
                  "max": 65535
                }
              ]
            }
          },
          "supplementalGroupsRule": {
            "value": "MustRunAs"
          },
          "supplementalGroupsRanges": {
            "value": {
              "ranges": [
                {
                  "min": 1,
                  "max": 65535
                }
              ]
            }
          },
          "fsGroupRule": {
            "value": "MustRunAs"
          },
          "fsGroupRanges": {
            "value": {
              "ranges": [
                {
                  "min": 1,
                  "max": 65535
                }
              ]
            }
          }
        }
      },
      {
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/975ce327-682c-4f2e-aa46-b9598289b86c",
        "policyDefinitionReferenceId": "AllowedSeccompProfiles",
        "parameters": {
          "effect": {
            "value": "[parameters('effect')]"
          },
          "excludedNamespaces": {
            "value": "[parameters('excludedNamespaces')]"
          },
          "namespaces": {
            "value": "[parameters('namespaces')]"
          },
          "allowedProfiles": {
            "value": [
              "runtime/default",
              "docker/default"
            ]
          }
        }
      }
    ]
  },
  "id": "/providers/Microsoft.Authorization/policySetDefinitions/42b8ef37-b724-4e24-bbc8-7a7708edfe00",
  "name": "42b8ef37-b724-4e24-bbc8-7a7708edfe00"
}