[Temp] use the u_id:g_id in webapp chart values

wireapp · Feb 1, 2024 · 6c55e61 · 6c55e61
1 parent acd0c97
commit 6c55e61
Showing 1 changed file with 33 additions and 0 deletions.
diff --git a/values/wire-server/prod-values.example.yaml b/values/wire-server/prod-values.example.yaml
@@ -282,6 +282,17 @@ webapp:
     CSP_EXTRA_STYLE_SRC: "https://*.example.com"
     CSP_EXTRA_WORKER_SRC: "https://*.example.com"
 
+  podSecurityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+  runAsNonRoot: true
+  runAsUser: 1000
+  runAsGroup: 1000
+  seccompProfile:
+    type: RuntimeDefault
+
 # NOTE: Only relevant if you want team-settings
 team-settings:
   replicaCount: 1
@@ -320,6 +331,17 @@ team-settings:
     CSP_EXTRA_WORKER_SRC: "https://*.example.com"
     IS_SELF_HOSTED: "true"
 
+  podSecurityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+  runAsNonRoot: true
+  runAsUser: 1000
+  runAsGroup: 1000
+  seccompProfile:
+    type: RuntimeDefault
+
 # NOTE: Only relevant if you want account-pages
 account-pages:
   replicaCount: 1
@@ -354,6 +376,17 @@ account-pages:
     CSP_EXTRA_WORKER_SRC: "https://*.example.com"
     IS_SELF_HOSTED: "true"
 
+  podSecurityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+  runAsNonRoot: true
+  runAsUser: 1000
+  runAsGroup: 1000
+  seccompProfile:
+    type: RuntimeDefault
+
 # Only needed when legalhold is enabled
 legalhold:
   host: "legalhold.example.com"