From d09d1357e3657e9357adff077a6db92e5fa43b5a Mon Sep 17 00:00:00 2001
From: Patrick Riehecky <riehecky@fnal.gov>
Date: Mon, 15 Jun 2026 11:46:51 -0500
Subject: [PATCH] feat(helm): set defaults matching pss-restricted

Signed-off-by: Patrick Riehecky <riehecky@fnal.gov>
---
 src/helm/reflector/values.yaml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/helm/reflector/values.yaml b/src/helm/reflector/values.yaml
index bb5cbc92..ab69172d 100644
--- a/src/helm/reflector/values.yaml
+++ b/src/helm/reflector/values.yaml
@@ -56,14 +56,18 @@ extraEnv: []
 
 podSecurityContext:
   fsGroup: 2000
+  seccompProfile:
+    type: RuntimeDefault
 
 securityContext:
   capabilities:
     drop:
       - ALL
   readOnlyRootFilesystem: true
+  allowPrivilegeEscalation: false
   runAsNonRoot: true
   runAsUser: 1000
+  runAsGroup: 2000
 
 livenessProbe:
   httpGet:
@@ -123,4 +127,4 @@ priorityClassName: ""
 
 volumes: []
 
-volumeMounts: []
\ No newline at end of file
+volumeMounts: []