feat(template): refined default configuration

template-chart/templates/xxx.deployment.yaml

@@ -16,6 +16,12 @@ spec:
         app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
     spec:
       automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 20000
+        runAsGroup: 1000
+        fsGroup: 1000
+        fsGroupChangePolicy: Always
       containers:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
           image: "registry/image:{{ .Chart.AppVersion }}"
@@ -25,13 +31,17 @@ spec:
               protocol: TCP
               name: http
           # TODO: Add liveness and readiness probes
+          {{- with .Values.xxx.resources }}
           resources:
-            requests:
+            {{ toYaml . | nindent 12 }}
-              memory: "{{ .Values.xxx.resources.requests.memory }}"
+          {{- end }}
-              cpu: "{{ .Values.xxx.resources.requests.cpu }}"
+          securityContext:
-              ephemeral-storage: "{{ .Values.xxx.resources.requests.ephemeralStorage }}"
+            allowPrivilegeEscalation: false
-            limits:
+            readOnlyRootFilesystem: true
-              memory: "{{ .Values.xxx.resources.limits.memory }}"
+            runAsNonRoot: true
-              cpu: "{{ .Values.xxx.resources.limits.cpu }}"
+            capabilities:
-              ephemeral-storage: "{{ .Values.xxx.resources.limits.ephemeralStorage }}"
+              drop:
+                - ALL
+              add:
+                -
       restartPolicy: Always

template-chart/templates/xxx.sfs.yaml

@@ -0,0 +1,48 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
+  labels:
+    app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
+spec:
+  replicas: 1
+  serviceName: {{ .Release.Name }}-{{ .Chart.Name }}-service
+  selector:
+    matchLabels:
+      app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
+  template:
+    metadata:
+      name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
+      labels:
+        app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 20000
+        runAsGroup: 1000
+        fsGroup: 1000
+        fsGroupChangePolicy: Always
+      containers:
+        - name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
+          image: "registry/image:{{ .Chart.AppVersion }}"
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 80
+              protocol: TCP
+              name: http
+          # TODO: Add liveness and readiness probes
+          {{- with .Values.xxx.resources }}
+          resources:
+            {{ toYaml . | nindent 12 }}
+          {{- end }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            capabilities:
+              drop:
+                - ALL
+              add:
+                -
+      restartPolicy: Always

template-chart/values.yaml

@@ -3,11 +3,11 @@ xxx:
     requests:
       cpu: 0.1
       memory: 512Mi
-      ephemeralStorage: 10Mi
+      ephemeral-storage: 10Mi
     limits:
       cpu: 1
       memory: 768Mi
-      ephemeralStorage: 100Mi
+      ephemeral-storage: 100Mi
 
 ingress:
   enabled: true