apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: descheduler
  namespace: kube-system
spec:
  interval: 10m
  releaseName: descheduler
  chart:
    spec:
      chart: descheduler
      version: "*"
      sourceRef:
        kind: HelmRepository
        name: descheduler
        namespace: flux-system
  values:
    schedule: "*/2 * * * *"
    successfulJobsHistoryLimit: 1
    failedJobsHistoryLimit: 1
    resources:
      limits:
        cpu: 100m
        memory: 128Mi
      requests:
        cpu: 50m
        memory: 64Mi
    # Security context
    podSecurityContext:
      runAsNonRoot: true
      runAsUser: 1000
      fsGroup: 1000
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL
      readOnlyRootFilesystem: true
      runAsNonRoot: true