Use containers securityContexts and podSecurityContexts in the base deployment.

[Cellebyte]

Examples containerSecurity which could be implemented.

Should that be a standard implementation in the release manifests from fluxctl?

...
      containers:
      - name: <name>
        securityContext:
          readOnlyRootFilesystem: true
          allowPrivilegeEscalation: false
          runAsNonRoot: true
          capabilities:
            drop:
              - ALL
...

Examples podSecurity

...
 securityContext:
    runAsUser: <uid>
    fsGroup: <gid>
...

Currently is uses the standard allow everything policy which is not great and also breaks the securityPolicies of our cluster.
The best way would be to have it upstream to ensure that it is correctly implemented. We can patch it on our own but if greater changes happen to how flux gets deployed it will brick.