Fix pod security (#204)

* Fix pod security

* Extra security context

* Use correct security context

.github/workflows/publish-helm.yml

@@ -33,5 +33,4 @@ jobs:
           CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
         with:
           charts_dir: helm
-          charts_repo_url: https://gothenburgbitfactory.org/taskchampion-sync-server/helm-chart
+          install_dir: helm-chart
-          pages_index_path: helm-charts

helm/taskchampion-sync-server/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: taskchampion-sync-server
 description: A Helm chart for deploying TaskChampion Sync Server on Kubernetes
 type: application
-version: 0.1.1
+version: 0.1.2
 appVersion: "0.7.0"
 keywords:
   - taskchampion

helm/taskchampion-sync-server/templates/deployment.yaml

@@ -30,6 +30,8 @@ spec:
         - name: postgres-init
           image: "{{ .Values.postgres.initContainer.image }}"
           imagePullPolicy: {{ .Values.postgres.initContainer.imagePullPolicy }}
+          securityContext:
+            allowPrivilegeEscalation: false
           env:
             - name: PGURI
               valueFrom:
@@ -86,6 +88,8 @@ spec:
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
           {{- end }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext:
+            allowPrivilegeEscalation: false
           env:
             {{- range $name, $value := .Values.env }}
             - name: {{ $name }}