add security contexts to download ns

cluster/apps/download/bazarr/helm-release.yaml

@@ -18,16 +18,20 @@ spec:
     image:
       repository: lscr.io/linuxserver/bazarr
       tag: latest
+
     env:
       TZ: America/New_York
+
     service:
       main:
         ports:
           http:
             port: 6767
+
     probes:
       liveness:
         enabled: false
+
     ingress:
       main:
         enabled: true
@@ -44,6 +48,7 @@ spec:
           - hosts:
               - *host
             secretName: wildcard-main-tls
+
     persistence:
       config:
         enabled: true
@@ -51,6 +56,13 @@ spec:
         hostPath: /mnt/MainPool/Kubernetes/bazarr
         mountPath: /config
 
+    podSecurityContext:
+      runAsNonRoot: true
+      runAsUser: 10000
+      runAsGroup: 10000
+      fsGroup: 10000
+      fsGroupChangePolicy: OnRootMismatch
+
     resources:
       requests:
         cpu: 5m

cluster/apps/download/mylar3/helm-release.yaml

@@ -18,20 +18,24 @@ spec:
     image:
       repository: lscr.io/linuxserver/mylar3
       tag: latest
+
     env:
       TZ: America/New_York
       PGID: "1000"
       PUID: "1000"
+      
     service:
       main:
         ports:
           http:
             port: 8090
+
     probes:
       liveness:
         enabled: false
       startup:
         enabled: false
+
     ingress:
       main:
         enabled: true
@@ -48,6 +52,7 @@ spec:
           - hosts:
               - *host
             secretName: wildcard-main-tls
+
     persistence:
       config:
         enabled: true
@@ -60,6 +65,13 @@ spec:
         hostPath: /mnt/MainPool/Media
         mountPath: /storage
 
+    podSecurityContext:
+      runAsNonRoot: true
+      runAsUser: 10000
+      runAsGroup: 10000
+      fsGroup: 10000
+      fsGroupChangePolicy: OnRootMismatch
+
     resources:
       requests:
         cpu: 1m

cluster/apps/download/prowlarr/helm-release.yaml

@@ -100,6 +100,13 @@ spec:
         hostPath: /mnt/MainPool/Kubernetes/prowlarr
         mountPath: /config
 
+    podSecurityContext:
+      runAsNonRoot: true
+      runAsUser: 10000
+      runAsGroup: 10000
+      fsGroup: 10000
+      fsGroupChangePolicy: OnRootMismatch
+
     resources:
       requests:
         cpu: 2m

cluster/apps/download/qbittorrent/helm-release.yaml

@@ -36,6 +36,12 @@ spec:
             add:
               - NET_ADMIN
 
+          runAsNonRoot: true
+          runAsUser: 10000
+          runAsGroup: 10000
+          fsGroup: 10000
+          fsGroupChangePolicy: OnRootMismatch
+
       metrics:
         image: caseyscarborough/qbittorrent-exporter:latest
         env:
@@ -94,6 +100,13 @@ spec:
         hostPath: /mnt/MainPool/Kubernetes/qbittorrent
         mountPath: /config
 
+    podSecurityContext:
+      runAsNonRoot: true
+      runAsUser: 10000
+      runAsGroup: 10000
+      fsGroup: 10000
+      fsGroupChangePolicy: OnRootMismatch
+
 #    resources:
 #      requests:
 #        cpu: 2m

cluster/apps/download/radarr/helm-release.yaml

@@ -107,6 +107,13 @@ spec:
         hostPath: /mnt/MainPool/Media
         mountPath: /storage
 
+    podSecurityContext:
+      runAsNonRoot: true
+      runAsUser: 10000
+      runAsGroup: 10000
+      fsGroup: 10000
+      fsGroupChangePolicy: OnRootMismatch
+
     resources:
       requests:
         cpu: 1m

cluster/apps/download/readarr/audiobook-helm.yaml

@@ -105,6 +105,13 @@ spec:
         hostPath: /mnt/MainPool/Media
         mountPath: /storage
 
+    podSecurityContext:
+      runAsNonRoot: true
+      runAsUser: 10000
+      runAsGroup: 10000
+      fsGroup: 10000
+      fsGroupChangePolicy: OnRootMismatch
+
     resources:
       requests:
         cpu: 1m

cluster/apps/download/sonarr/helm-release.yaml

@@ -107,6 +107,13 @@ spec:
         hostPath: /mnt/MainPool/Media
         mountPath: /storage
 
+    podSecurityContext:
+      runAsNonRoot: true
+      runAsUser: 10000
+      runAsGroup: 10000
+      fsGroup: 10000
+      fsGroupChangePolicy: OnRootMismatch
+
     resources:
       requests:
         cpu: 2m

cluster/apps/download/unpackerr/helm-release.yaml

@@ -48,6 +48,13 @@ spec:
         hostPath: /mnt/MainPool/Media
         mountPath: /storage
 
+    podSecurityContext:
+      runAsNonRoot: true
+      runAsUser: 10000
+      runAsGroup: 10000
+      fsGroup: 10000
+      fsGroupChangePolicy: OnRootMismatch
+
     resources:
       requests:
         cpu: 2m