true up securityContext

observIQ · Feb 19, 2024 · c60effd · c60effd
1 parent d49993a
commit c60effd
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/charts/bindplane/templates/prometheus.yaml b/charts/bindplane/templates/prometheus.yaml
@@ -30,7 +30,11 @@ spec:
           image: ghcr.io/observiq/bindplane-prometheus:{{ include "bindplane.tag" . }}
           imagePullPolicy: IfNotPresent
           securityContext:
+            runAsNonRoot: true
             readOnlyRootFilesystem: true
+            runAsUser: 65534
+            capabilities:
+              drop: ["ALL"]
           ports:
             - name: http
               containerPort: 9090