From 483d29ee0e6ba857ba0b0e2052ad7fbe71d0bff9 Mon Sep 17 00:00:00 2001
From: kjeld Schouten-Lebbing <kjeld@schouten-lebbing.nl>
Date: Sat, 25 Sep 2021 12:10:24 +0200
Subject: [PATCH] harden default security options for common

---
 charts/library/common/Chart.yaml  |  2 +-
 charts/library/common/values.yaml | 12 +++++++++---
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/charts/library/common/Chart.yaml b/charts/library/common/Chart.yaml
index dce2bb66d9c..076381bf393 100644
--- a/charts/library/common/Chart.yaml
+++ b/charts/library/common/Chart.yaml
@@ -15,4 +15,4 @@ maintainers:
 name: common
 sources: null
 type: library
-version: 7.0.14
+version: 8.0.0
diff --git a/charts/library/common/values.yaml b/charts/library/common/values.yaml
index f3a35f9f59d..88633a0bac9 100644
--- a/charts/library/common/values.yaml
+++ b/charts/library/common/values.yaml
@@ -247,13 +247,19 @@ dnsConfig:
 enableServiceLinks: false
 
 # -- Configure the Security Context for the Pod
-podSecurityContext: {}
+podSecurityContext:
+  runAsUser: 568
+  runAsGroup: 568
+  fsGroup: 568
+  supplementalGroups: []
+  fsGroupChangePolicy: OnRootMismatch
 
 # -- Configure the Security Context for the main container
 securityContext:
   privileged: false
-  readOnlyRootFilesystem: false
-  allowPrivilegeEscalation: true
+  readOnlyRootFilesystem: true
+  allowPrivilegeEscalation: false
+  runAsNonRoot: true
 
 
 # -- Configure the lifecycle for the main container