#@ load("@ytt:overlay", "overlay")

#@ helm_match = overlay.subset({"metadata": {"labels": {"app.kubernetes.io/managed-by": "Helm"}}})

#@overlay/match by=overlay.and_op(overlay.subset({"kind": "Deployment"}), helm_match), expects="1+"
---
spec:
  template:
    spec:
      securityContext:
        #@overlay/match missing_ok=True
        seccompProfile:
          type: RuntimeDefault
      containers:
      #@overlay/match by=overlay.all, expects="1+"
      -
        securityContext:
          #@overlay/match missing_ok=True
          allowPrivilegeEscalation: false
          #@overlay/match missing_ok=True
          capabilities:
            drop:
            - ALL

#! idm is the only chart Deployment with initContainers
#@overlay/match by=overlay.subset({"kind": "Deployment", "metadata": {"name": "idm"}})
---
spec:
  template:
    spec:
      initContainers:
      #@overlay/match by=overlay.all, expects="1+"
      -
        securityContext:
          #@overlay/match missing_ok=True
          allowPrivilegeEscalation: false
          #@overlay/match missing_ok=True
          capabilities:
            drop:
            - ALL

#@overlay/match by=overlay.and_op(overlay.subset({"kind": "CronJob"}), helm_match), expects="1+"
---
spec:
  jobTemplate:
    spec:
      template:
        spec:
          securityContext:
            #@overlay/match missing_ok=True
            seccompProfile:
              type: RuntimeDefault
          containers:
          #@overlay/match by=overlay.all, expects="1+"
          -
            securityContext:
              #@overlay/match missing_ok=True
              allowPrivilegeEscalation: false
              #@overlay/match missing_ok=True
              capabilities:
                drop:
                - ALL
