apiVersion: v1
kind: Pod
metadata:
  name: security-context-pod
spec:
  securityContext:
    runAsUser: 2500
    fsGroup: 2000
  containers:
    - name: security-context-cont
      image: supergiantkir/k8s-liveliness
      ports:
        - name: web
          containerPort: 80
          hostPort: 80
          protocol: TCP
      securityContext:
        allowPrivilegeEscalation: false
        runAsUser: 2500
        runAsGroup: 2500
        readOnlyRootFilesystem: true
        capabilities:
          add:
            - SYS_CHROOT
            - AUDIT_WRITE
          drop:
            - AAA
      volumeMounts:
        - name: tmp
          mountPath: /var/tmp
        - name: security-context-vol
          mountPath: /data/test
          readOnly: true
    - name: security-context-bg
      image: supergiantkir/k8s-liveliness
      ports:
        - name: web
          containerPort: 8080
          hostPort: 8080
          protocol: TCP
      volumeMounts:
        - name: security-context-vol
          mountPath: /data/test
          readOnly: true
      securityContext:
        allowPrivilegeEscalation: false
        runAsUser: 2400
        runAsGroup: 2400
        capabilities:
          add:
            - SYS_CHROOT
            - SYS_ADMIN
            - AUDIT_WRITE
  volumes:
    - name: tmp
      hostPath:
        path: /tmp
        type: Directory
    - name: security-context-vol
      hostPath:
        path: /test
        type: Directory