Update all services to have increased security settings

charts/primary-site/templates/cronjobs/garbage-collector.yaml

@@ -33,6 +33,11 @@ spec:
           containers:
             - name: garbage-collector
               image: {{ .Values.garbageCollector.deployment.image }}:{{ .Chart.AppVersion }}
+              securityContext:
+                allowPrivilegeEscalation: false
+                runAsNonRoot: true
+                runAsUser: 65534
+                runAsGroup: 65534
               volumeMounts:
                 - mountPath: /secrets
                   name: cloud-credentials

charts/primary-site/templates/deployments/_inbox-container.tpl

@@ -40,6 +40,11 @@ template:
     containers:
       - name: inbox-listener
         image: {{ .Values.inboxListener.deployment.image }}:{{ .Chart.AppVersion }}
+        securityContext:
+          allowPrivilegeEscalation: false
+          runAsNonRoot: true
+          runAsUser: 65534
+          runAsGroup: 65534
         resources:
           requests:
             cpu: {{ .Values.inboxListener.deployment.resources.requests.cpu }}

charts/primary-site/templates/deployments/kube-state-metrics.yaml

@@ -64,6 +64,7 @@ spec:
             readOnlyRootFilesystem: true
             runAsNonRoot: true
             runAsUser: 65534
+            runAsGroup: 65534
             seccompProfile:
               type: RuntimeDefault
           args:

charts/primary-site/templates/deployments/query-server.yaml

@@ -43,6 +43,11 @@ spec:
       containers:
         - name: query-service
           image: {{ $values.deployment.image }}:{{ .Chart.AppVersion }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 65534
+            runAsGroup: 65534
           resources:
             requests:
               cpu: {{ $values.deployment.resources.requests.cpu }}

charts/primary-site/templates/deployments/site-controller.yaml

@@ -34,6 +34,11 @@ spec:
       containers:
         - name: site-controller
           image: {{ .Values.siteController.deployment.image }}:{{ .Chart.AppVersion }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 65534
+            runAsGroup: 65534
           resources:
             requests:
               cpu: {{ .Values.siteController.deployment.resources.requests.cpu }}