add kyverno policies

Signed-off-by: gwg313 <gwg313@pm.me>

apps/audiobookshelf/deployment.yaml

@@ -15,8 +15,16 @@ spec:
       labels:
         app: audiobookshelf
     spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 1000
       containers:
         - name: audiobookshelf
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 1000
           image: ghcr.io/advplyr/audiobookshelf:2.35.0
           imagePullPolicy: IfNotPresent
           ports:

apps/navidrome/deployment.yaml

@@ -15,8 +15,17 @@ spec:
       labels:
         app: navidrome
     spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 1000
       containers:
         - name: navidrome
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 1000
+            readOnlyRootFilesystem: false
           image: deluan/navidrome:pr-5495
           ports:
             - containerPort: 4533

apps/stirling-pdf/deployment.yaml

@@ -14,9 +14,15 @@ spec:
         app: stirling-pdf
     spec:
       securityContext:
-        fsGroup: 1000
+      runAsNonRoot: true
+      runAsUser: 1000
+      fsGroup: 1000
       containers:
         - name: stirling-pdf
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 1000
           image: docker.stirlingpdf.com/stirlingtools/stirling-pdf:2.11.0-fat
           resources:
             requests:
@@ -43,7 +49,25 @@ spec:
             - name: stirling-data
               mountPath: /pipeline
               subPath: pipeline
+
+            - name: stirling-user
+              mountPath: /home
+
+            - name: tmp
+              mountPath: /tmp
+            - name: stirling
+              mountPath: /tmp/stirling-pdf
+            - name: app-data
+              mountPath: /usr/local/bin
       volumes:
         - name: stirling-data
           persistentVolumeClaim:
             claimName: stirling-data
+        - name: tmp
+          emptyDir: {}
+        - name: stirling
+          emptyDir: {}
+        - name: app-data
+          emptyDir: {}
+        - name: stirling-user
+          emptyDir: {}

apps/yopass/deployment.yaml

@@ -12,8 +12,17 @@ spec:
       labels:
         app.kubernetes.io/name: yopass
     spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 1000
       containers:
         - name: yopass
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 1000
+            readOnlyRootFilesystem: false
           image: jhaals/yopass:13.1.0
           args:
             - "--memcached=localhost:11211"