tika:
  # The official image runs as the dedicated user 35002:35002. /tmp is a
  # writable emptyDir because Tika writes temporary files while parsing.
  securityContext:
    pod:
      runAsNonRoot: true
      runAsUser: 35002
      runAsGroup: 35002
    container:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      runAsNonRoot: true
      capabilities:
        drop:
          - ALL
  # Tika answers "GET /" on its server port with HTTP 200.
  livenessProbe:
    httpGet:
      path: /
      port: tika-port
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 3
  readinessProbe:
    httpGet:
      path: /
      port: tika-port
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 3
  # The startup probe gates liveness/readiness. Startup budget = 5s * 30 = 150s.
  startupProbe:
    httpGet:
      path: /
      port: tika-port
    periodSeconds: 5
    timeoutSeconds: 5
    failureThreshold: 30
  resources:
    requests:
      cpu: 0.1
      memory: 512Mi
      ephemeralStorage: 10Mi
    limits:
      cpu: 100m
      memory: 768Mi
      ephemeralStorage: 100Mi