apiVersion: v1
kind: Namespace
metadata:
  name: runtime-hardening
---
apiVersion: v1
kind: Pod
metadata:
  name: event-forwarder
  namespace: runtime-hardening

spec:
  volumes:
  - name: tmp
    emptyDir: {}
  securityContext:
    runAsUser: 1000
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
    appArmorProfile:
      type: RuntimeDefault
  containers:
  - name: forwarder
    image: busybox:1.37
    command: ["sh","-c","sleep 3600"]
    volumeMounts:
    - name: tmp
      mountPath: /tmp
    securityContext:
      readOnlyRootFilesystem: true
  - name: metrics
    image: busybox:1.37
    command: ["sh","-c","sleep 3600"]
    volumeMounts:
    - name: tmp
      mountPath: /tmp
    securityContext:
      readOnlyRootFilesystem: true
      allowPrivilegeEscalation: false
      capabilities:
        drop: ["ALL"]