From 78df9dce6a04673150e4019f4d1db4c6ac4cb52a Mon Sep 17 00:00:00 2001
From: jklein <github@justin-klein.de>
Date: Mon, 13 Apr 2026 21:28:41 +0200
Subject: [PATCH] feat(voucher-vault): fixed security-policies

---
 voucher-vault/Chart.yaml                      |  2 +-
 .../templates/voucher-vault.sfs.yaml          |  6 +++
 voucher-vault/values.yaml                     | 38 +++----------------
 3 files changed, 13 insertions(+), 33 deletions(-)

diff --git a/voucher-vault/Chart.yaml b/voucher-vault/Chart.yaml
index 6c28f09..48d9fae 100644
--- a/voucher-vault/Chart.yaml
+++ b/voucher-vault/Chart.yaml
@@ -4,7 +4,7 @@ description: A Helm chart to deploy VoucherVault on Kubernetes
 
 type: application
 
-version: 1.2.0+up1.27.4
+version: 1.3.0+up1.27.4
 appVersion: "1.27.4"
 
 maintainers:
diff --git a/voucher-vault/templates/voucher-vault.sfs.yaml b/voucher-vault/templates/voucher-vault.sfs.yaml
index 7c6a22d..f0f1032 100644
--- a/voucher-vault/templates/voucher-vault.sfs.yaml
+++ b/voucher-vault/templates/voucher-vault.sfs.yaml
@@ -46,12 +46,18 @@ spec:
             {{- end }}
           ports:
             {{- toYaml .Values.voucherVault.ports | nindent 12 }}
+          {{- if .Values.voucherVault.livenessProbe }}
           livenessProbe:
             {{- toYaml .Values.voucherVault.livenessProbe | nindent 12 }}
+          {{- end }}
+          {{- if .Values.voucherVault.readinessProbe }}
           readinessProbe:
             {{- toYaml .Values.voucherVault.readinessProbe | nindent 12 }}
+          {{- end }}
+          {{- if .Values.voucherVault.startupProbe }}
           startupProbe:
             {{- toYaml .Values.voucherVault.startupProbe | nindent 12 }}
+          {{- end }}
           resources:
             {{- toYaml .Values.voucherVault.resources | nindent 12 }}
           securityContext:
diff --git a/voucher-vault/values.yaml b/voucher-vault/values.yaml
index 0b696d8..26b1cca 100644
--- a/voucher-vault/values.yaml
+++ b/voucher-vault/values.yaml
@@ -14,45 +14,19 @@ voucherVault:
       memory: 384Mi
       ephemeral-storage: 100Mi
   # TODO: Refine liness, readiness, startup probes
-  livenessProbe:
-    httpGet:
-      path: /
-      port: http
-    initialDelaySeconds: 10
-    periodSeconds: 10
-    timeoutSeconds: 5
-    failureThreshold: 3
-  readinessProbe:
-    httpGet:
-      path: /
-      port: http
-    initialDelaySeconds: 10
-    periodSeconds: 10
-    timeoutSeconds: 5
-    failureThreshold: 3
-  startupProbe:
-    httpGet:
-      path: /
-      port: http
-    initialDelaySeconds: 30
-    periodSeconds: 10
-    timeoutSeconds: 5
-    failureThreshold: 3
+  livenessProbe: null
+  readinessProbe: null
+  startupProbe: null
   securityContext:
     pod:
       runAsNonRoot: true
-      runAsUser: 20000
-      runAsGroup: 1000
-      fsGroup: 1000
+      runAsUser: 33
+      runAsGroup: 33
+      fsGroup: 33
       fsGroupChangePolicy: Always
     container:
       allowPrivilegeEscalation: false
-      readOnlyRootFilesystem: true
       runAsNonRoot: true
-      capabilities:
-        drop:
-          - ALL
-        add: []
   ports:
     - containerPort: 8000
       protocol: TCP