Customizing capability in migrating pod security admission

From my understanding, in the pod security admission(PSA), there is no customization feature. We can only select one of the security levels (privileged, baseline or restricted)

Now, there is a pod which uses capability CAP_NET_ADMIN only. But, as you know, the 'baseline' level of PSA doesn't include CAP_NET_ADMIN. As a result, should this pod be created with 'privileged' level? Is my understanding correct? Is this an only way to setup this pod with PSA? I wonder it, because I think it's not good for security.

Could you please share your opinions about it?

The default security levels provided by pod security policies cannot be changed directly and are pre-defined. To define your custom policies, you can use solutions like kyverno and define your own policy which combines the "baseline" policy with an exception to include "CAP_NET_ADMIN" capability. Any example is given below:

kind: ClusterPolicy
metadata:
  name: customized-baseline-policy
spec:
  background: false
  rules:
    - name: enforce-baseline-policy
      match:
        resources:
          kinds:
            - Pod
      validate:
        message: "The pod does not comply with the customized baseline policy."
        pattern:
          spec:
            containers:
              - securityContext:
                  readOnlyRootFilesystem: true
            hostIPC: false
            hostPID: false
            hostNetwork: false

<ADD MORE POLICIES HERE AS DEFINED IN THE BASELINE POLICY>

      mutate:
        patchStrategicMerge:
          metadata:
            annotations:
              kyverno.io/generated-by: customized-baseline-policy
          spec:
            containers:
              - securityContext:
                  capabilities:
                    add: ["NET_ADMIN"]