From 1a4f1d94b6d47517c4e062f4ae7bf6587c032ec0 Mon Sep 17 00:00:00 2001
From: Jansen Fuller <jansendfuller@mailfence.com>
Date: Fri, 29 May 2026 18:06:47 +0000
Subject: [PATCH] Fix pod security (#204)

* Fix pod security

* Extra security context

* Use correct security context
---
 helm/taskchampion-sync-server/Chart.yaml                | 2 +-
 helm/taskchampion-sync-server/templates/deployment.yaml | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/helm/taskchampion-sync-server/Chart.yaml b/helm/taskchampion-sync-server/Chart.yaml
index 6f46da7..a7ac268 100644
--- a/helm/taskchampion-sync-server/Chart.yaml
+++ b/helm/taskchampion-sync-server/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: taskchampion-sync-server
 description: A Helm chart for deploying TaskChampion Sync Server on Kubernetes
 type: application
-version: 0.1.1
+version: 0.1.2
 appVersion: "0.7.0"
 keywords:
   - taskchampion
diff --git a/helm/taskchampion-sync-server/templates/deployment.yaml b/helm/taskchampion-sync-server/templates/deployment.yaml
index ccc3c8f..2ee7409 100644
--- a/helm/taskchampion-sync-server/templates/deployment.yaml
+++ b/helm/taskchampion-sync-server/templates/deployment.yaml
@@ -30,6 +30,8 @@ spec:
         - name: postgres-init
           image: "{{ .Values.postgres.initContainer.image }}"
           imagePullPolicy: {{ .Values.postgres.initContainer.imagePullPolicy }}
+          securityContext:
+            allowPrivilegeEscalation: false
           env:
             - name: PGURI
               valueFrom:
@@ -86,6 +88,8 @@ spec:
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
           {{- end }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext:
+            allowPrivilegeEscalation: false
           env:
             {{- range $name, $value := .Values.env }}
             - name: {{ $name }}