feat: tidy up opensearch-backup job and script

ministryofjustice · Nov 18, 2024 · 4bee540 · 4bee540
1 parent 031a908
commit 4bee540
Showing 1 changed file with 12 additions and 7 deletions.
diff --git a/jobs/opensearch-backup/templates/job.yaml b/jobs/opensearch-backup/templates/job.yaml
@@ -7,12 +7,6 @@ spec:
   template:
     spec:
       serviceAccountName: "{{ $.Values.opensearch.serviceAccountPrefix }}-{{ $.Values.opensearch.environment }}"
-      securityContext:
-        allowPrivilegeEscalation: false
-        privileged: false
-        readOnlyRootFilesystem: false
-        runAsNonRoot: true
-        runAsUser: 999
       containers:
         - name: opensearch-backup
           image: ghcr.io/ministryofjustice/hmpps-delius-alfresco-utils:latest
@@ -48,9 +42,20 @@ spec:
           volumeMounts:
             - name: script
               mountPath: /scripts
+          securityContext:
+            allowPrivilegeEscalation: false
+            privileged: false
+            readOnlyRootFilesystem: false
+            runAsNonRoot: true
+            runAsUser: 999
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
       volumes:
         - name: script
           configMap:
             name: opensearch-backup-script
             defaultMode: 0755
-      restartPolicy: Never
+      restartPolicy: Never