add kyverno policies

Signed-off-by: gwg313 <gwg313@pm.me>
2026-05-27 19:23:54 -04:00 · 2026-05-27 19:23:54 -04:00 · baa0216960
commit baa0216960
parent 4be877e419
35 changed files with 843 additions and 39 deletions
--- a/apps/navidrome/deployment.yaml
+++ b/apps/navidrome/deployment.yaml
@ -15,8 +15,17 @@ spec:
      labels:
        app: navidrome
    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 1000
      containers:
        - name: navidrome
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 1000
+            readOnlyRootFilesystem: false
          image: deluan/navidrome:pr-5495
          ports:
            - containerPort: 4533