#@ load("@ytt:overlay", "overlay")

#@overlay/match by=overlay.subset({"kind": "StatefulSet", "metadata": {"name": "victoria-metrics-single-server"}})
---
spec:
  template:
    spec:
      #@overlay/replace
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      containers:
      #@overlay/match by=overlay.subset({"name": "vmsingle"})
      -
        #@overlay/replace
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          capabilities:
            drop:
              - ALL
