feat(template): refined default configuration

template-chart/templates/xxx.deployment.yaml

@@ -16,6 +16,12 @@ spec:
         app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
     spec:
       automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 20000
+        runAsGroup: 1000
+        fsGroup: 1000
+        fsGroupChangePolicy: Always
       containers:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
           image: "registry/image:{{ .Chart.AppVersion }}"
@@ -25,13 +31,17 @@ spec:
               protocol: TCP
               name: http
           # TODO: Add liveness and readiness probes
+          {{- with .Values.xxx.resources }}
           resources:
-            requests:
-              memory: "{{ .Values.xxx.resources.requests.memory }}"
-              cpu: "{{ .Values.xxx.resources.requests.cpu }}"
-              ephemeral-storage: "{{ .Values.xxx.resources.requests.ephemeralStorage }}"
-            limits:
-              memory: "{{ .Values.xxx.resources.limits.memory }}"
-              cpu: "{{ .Values.xxx.resources.limits.cpu }}"
-              ephemeral-storage: "{{ .Values.xxx.resources.limits.ephemeralStorage }}"
+            {{ toYaml . | nindent 12 }}
+          {{- end }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            capabilities:
+              drop:
+                - ALL
+              add:
+                -
       restartPolicy: Always