From 3028f97cdbbb0aee17de3a3e623e4f4a900448ab Mon Sep 17 00:00:00 2001
From: jklein <github@justin-klein.de>
Date: Sat, 4 Apr 2026 14:30:47 +0200
Subject: [PATCH] feat(template): refined default configuration

---
 template-chart/templates/xxx.deployment.yaml | 26 +++++++----
 template-chart/templates/xxx.sfs.yaml        | 48 ++++++++++++++++++++
 template-chart/values.yaml                   |  4 +-
 3 files changed, 68 insertions(+), 10 deletions(-)
 create mode 100644 template-chart/templates/xxx.sfs.yaml

diff --git a/template-chart/templates/xxx.deployment.yaml b/template-chart/templates/xxx.deployment.yaml
index ccb563d..b865bce 100644
--- a/template-chart/templates/xxx.deployment.yaml
+++ b/template-chart/templates/xxx.deployment.yaml
@@ -16,6 +16,12 @@ spec:
         app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
     spec:
       automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 20000
+        runAsGroup: 1000
+        fsGroup: 1000
+        fsGroupChangePolicy: Always
       containers:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
           image: "registry/image:{{ .Chart.AppVersion }}"
@@ -25,13 +31,17 @@ spec:
               protocol: TCP
               name: http
           # TODO: Add liveness and readiness probes
+          {{- with .Values.xxx.resources }}
           resources:
-            requests:
-              memory: "{{ .Values.xxx.resources.requests.memory }}"
-              cpu: "{{ .Values.xxx.resources.requests.cpu }}"
-              ephemeral-storage: "{{ .Values.xxx.resources.requests.ephemeralStorage }}"
-            limits:
-              memory: "{{ .Values.xxx.resources.limits.memory }}"
-              cpu: "{{ .Values.xxx.resources.limits.cpu }}"
-              ephemeral-storage: "{{ .Values.xxx.resources.limits.ephemeralStorage }}"
+            {{ toYaml . | nindent 12 }}
+          {{- end }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            capabilities:
+              drop:
+                - ALL
+              add:
+                -
       restartPolicy: Always
diff --git a/template-chart/templates/xxx.sfs.yaml b/template-chart/templates/xxx.sfs.yaml
new file mode 100644
index 0000000..7571a33
--- /dev/null
+++ b/template-chart/templates/xxx.sfs.yaml
@@ -0,0 +1,48 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
+  labels:
+    app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
+spec:
+  replicas: 1
+  serviceName: {{ .Release.Name }}-{{ .Chart.Name }}-service
+  selector:
+    matchLabels:
+      app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
+  template:
+    metadata:
+      name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
+      labels:
+        app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 20000
+        runAsGroup: 1000
+        fsGroup: 1000
+        fsGroupChangePolicy: Always
+      containers:
+        - name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
+          image: "registry/image:{{ .Chart.AppVersion }}"
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 80
+              protocol: TCP
+              name: http
+          # TODO: Add liveness and readiness probes
+          {{- with .Values.xxx.resources }}
+          resources:
+            {{ toYaml . | nindent 12 }}
+          {{- end }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            capabilities:
+              drop:
+                - ALL
+              add:
+                -
+      restartPolicy: Always
diff --git a/template-chart/values.yaml b/template-chart/values.yaml
index d1d559d..98ca668 100644
--- a/template-chart/values.yaml
+++ b/template-chart/values.yaml
@@ -3,11 +3,11 @@ xxx:
     requests:
       cpu: 0.1
       memory: 512Mi
-      ephemeralStorage: 10Mi
+      ephemeral-storage: 10Mi
     limits:
       cpu: 1
       memory: 768Mi
-      ephemeralStorage: 100Mi
+      ephemeral-storage: 100Mi
 
 ingress:
   enabled: true