Disallow Capabilities (Strict) in ValidatingPolicy

apiVersion: policies.kyverno.io/v1alpha1
kind: ValidatingPolicy
metadata:
  name: disallow-capabilities-strict
  annotations:
    policies.kyverno.io/title: Disallow Capabilities (Strict) in ValidatingPolicy
    policies.kyverno.io/category: Pod Security Standards (Restricted) in ValidatingPolicy
    policies.kyverno.io/severity: medium
    policies.kyverno.io/minversion: 1.14.0
    kyverno.io/kyverno-version: 1.14.0
    kyverno.io/kubernetes-version: 1.30+
    policies.kyverno.io/subject: Pod
    policies.kyverno.io/description: Adding capabilities other than `NET_BIND_SERVICE` is disallowed. In addition, all containers must explicitly drop `ALL` capabilities.
spec:
  validationActions:
    - Audit
  evaluation:
    background:
      enabled: true
  matchConstraints:
    resourceRules:
      - apiGroups:
          - ""
        apiVersions:
          - v1
        operations:
          - CREATE
          - UPDATE
        resources:
          - pods
  variables:
    - name: allContainers
      expression: object.spec.containers +  (object.spec.?initContainers.orValue([])) +  (object.spec.?ephemeralContainers.orValue([]))
  validations:
    - expression: variables.allContainers.all(container,  container.?securityContext.?capabilities.?drop.orValue([]).exists_one(capability, capability == 'ALL'))
      message: Containers must drop `ALL` capabilities.
    - expression: |-
        variables.allContainers.all(container, 
          container.?securityContext.?capabilities.?add.orValue([]).size() == 0 || 
          (container.securityContext.capabilities.add.orValue([]).size() == 1 && 
          container.securityContext.capabilities.add[0] == 'NET_BIND_SERVICE'))
      message: Any capabilities added other than NET_BIND_SERVICE are disallowed.