Phase 10: hardening and ops

Implements PLAN.md Phase 10.

Simplified Sliding Sync (MSC4186) is served at the unstable
org.matrix.simplified_msc3575 endpoint and advertised in /versions. Lists
are sorted by activity and filtered by DM, invite, encryption, room type,
space and tag; room subscriptions, required_state with wildcards, $ME and
$LAZY, and the to_device, e2ee, account_data, receipts and typing
extensions are supported. Per-connection state is kept in memory and an
unknown pos answers M_UNKNOWN_POS.

Threads and relations: m.relates_to is indexed on roomserver_events
(migration 0012), /relations (with recursion) and /threads are served, and
every event a timeline read returns carries its m.thread, m.replace and
m.reference summaries in unsigned.m.relations. Notifications carry a
thread ID (migration 0013): threaded receipts clear only their thread, and
sync reports unread_thread_notifications when the filter asks.

Spaces: /hierarchy walks a space breadth first, asking other servers about
rooms this one is not in through the new federation hierarchy endpoint;
room_summary describes one room. /search runs on FTS5 (sqlite, pocketbase)
or tsvector (postgres), bounded to what each user may see, with context,
profiles, state, grouping and paging.

The PocketBase driver is real: the sqlite schema and store on an embedded
PocketBase app's database, with media in its filesystem, local or S3
(database.pocketbase.s3). It runs the full storage test suite.

Ops: OpenTelemetry tracing over OTLP/HTTP (tracing.*), with server spans
per route, component spans, and trace propagation on federation, push and
application service calls. New metrics for persisted events, waiting
syncs, sliding sync connections and the database pool, with a Grafana
dashboard. deploy/ adds a Compose setup (PostgreSQL, Prometheus, Grafana,
Jaeger) and a Helm chart; cmd/warp-loadtest loads a server and reports
request and delivery latencies.

The load tester found a long-standing bug, fixed here: on a server where
no account data had been written, every incremental /sync re-sent the push
rules and returned at once, and an all-zero token was taken for an initial
sync, so long polls became busy loops.

The PostgreSQL migrations and search dialect compile but were not run
against a live PostgreSQL in this change.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/compose/docker-compose.yml

@@ -0,0 +1,105 @@
+# Warp with PostgreSQL, and optionally Prometheus, Grafana and Jaeger.
+#
+#   cd deploy/compose
+#   WARP_SERVER_NAME=matrix.example.org docker compose up -d
+#   docker compose --profile observability up -d     # with the dashboards
+#
+# The homeserver listens on http://localhost:8008. Put a TLS-terminating
+# reverse proxy in front of it before pointing a domain at it; see
+# docs/deployment.md. With the observability profile, Grafana is on
+# http://localhost:3000 (admin / admin, change it), Prometheus on :9090 and
+# the Jaeger UI on :16686.
+#
+# Create the first administrator once the server is up:
+#
+#   docker compose exec warp warp create-account --username admin --admin
+
+name: warp
+
+services:
+  postgres:
+    image: postgres:17-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: warp
+      POSTGRES_PASSWORD: ${WARP_POSTGRES_PASSWORD:-warp}
+      POSTGRES_DB: warp
+      # The encoding and collation a Matrix server's text wants: C sorts by
+      # byte, which is what room and event IDs are compared by.
+      POSTGRES_INITDB_ARGS: --encoding=UTF8 --lc-collate=C --lc-ctype=C
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U warp -d warp"]
+      interval: 5s
+      timeout: 5s
+      retries: 20
+
+  warp:
+    build:
+      context: ../..
+      dockerfile: Dockerfile
+    image: warp:latest
+    restart: unless-stopped
+    depends_on:
+      postgres:
+        condition: service_healthy
+    # The signing key is created on first start and kept in the volume:
+    # losing it means other servers no longer recognise this one.
+    entrypoint: ["/bin/sh", "-c"]
+    command:
+      - test -f /data/signing.key || warp generate-keys --output /data/signing.key; exec warp serve
+    environment:
+      WARP_SERVER_NAME: ${WARP_SERVER_NAME:-localhost}
+      WARP_WELL_KNOWN_CLIENT_BASE_URL: ${WARP_PUBLIC_BASEURL:-http://localhost:8008}
+      WARP_DB_DRIVER: postgres
+      WARP_DB_CONNECTION_STRING: postgres://warp:${WARP_POSTGRES_PASSWORD:-warp}@postgres:5432/warp?sslmode=disable
+      WARP_REGISTRATION_ENABLED: ${WARP_REGISTRATION_ENABLED:-false}
+      WARP_FEDERATION_ENABLED: ${WARP_FEDERATION_ENABLED:-false}
+      WARP_TRACING_ENABLED: ${WARP_TRACING_ENABLED:-false}
+      WARP_TRACING_ENDPOINT: http://jaeger:4318
+    volumes:
+      - warp-data:/data
+    ports:
+      - "8008:8008"
+
+  prometheus:
+    image: prom/prometheus:v3.5.0
+    profiles: [observability]
+    restart: unless-stopped
+    command:
+      - --config.file=/etc/prometheus/prometheus.yml
+      - --storage.tsdb.retention.time=15d
+    volumes:
+      - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
+      - prometheus-data:/prometheus
+    ports:
+      - "9090:9090"
+
+  grafana:
+    image: grafana/grafana:12.1.0
+    profiles: [observability]
+    restart: unless-stopped
+    environment:
+      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:-admin}
+      GF_AUTH_ANONYMOUS_ENABLED: "false"
+    volumes:
+      - ./grafana/provisioning:/etc/grafana/provisioning:ro
+      - ../grafana:/var/lib/grafana/dashboards/warp:ro
+      - grafana-data:/var/lib/grafana
+    ports:
+      - "3000:3000"
+
+  # Turn on WARP_TRACING_ENABLED=true to send traces here.
+  jaeger:
+    image: jaegertracing/jaeger:2.8.0
+    profiles: [observability]
+    restart: unless-stopped
+    ports:
+      - "16686:16686"
+
+volumes:
+  postgres-data:
+  warp-data:
+  prometheus-data:
+  grafana-data:

deploy/compose/grafana/provisioning/dashboards/warp.yml

@@ -0,0 +1,11 @@
+apiVersion: 1
+
+# The dashboards in deploy/grafana, mounted read-only into the container.
+providers:
+  - name: warp
+    folder: Warp
+    type: file
+    disableDeletion: true
+    allowUiUpdates: false
+    options:
+      path: /var/lib/grafana/dashboards/warp

deploy/compose/grafana/provisioning/datasources/prometheus.yml

@@ -0,0 +1,14 @@
+apiVersion: 1
+
+datasources:
+  - name: Prometheus
+    type: prometheus
+    uid: prometheus
+    access: proxy
+    url: http://prometheus:9090
+    isDefault: true
+  - name: Jaeger
+    type: jaeger
+    uid: jaeger
+    access: proxy
+    url: http://jaeger:16686

deploy/compose/prometheus.yml

@@ -0,0 +1,10 @@
+# Prometheus for the compose setup: scrapes Warp's /metrics.
+global:
+  scrape_interval: 15s
+  evaluation_interval: 15s
+
+scrape_configs:
+  - job_name: warp
+    metrics_path: /metrics
+    static_configs:
+      - targets: ["warp:8008"]

deploy/helm/warp/.helmignore

@@ -0,0 +1,4 @@
+.git/
+*.swp
+*.bak
+*.tmp

deploy/helm/warp/Chart.yaml

@@ -0,0 +1,9 @@
+apiVersion: v2
+name: warp
+description: Warp, a Matrix homeserver in Go — one process, one container.
+type: application
+# The chart's own version; bump it with every chart change.
+version: 0.1.0
+# The Warp version the chart deploys by default (the image tag).
+appVersion: "0.10.0"
+keywords: [matrix, homeserver, chat]

deploy/helm/warp/templates/NOTES.txt

@@ -0,0 +1,17 @@
+Warp is starting as {{ .Values.serverName }}.
+
+Create the first administrator:
+
+  kubectl exec -n {{ .Release.Namespace }} deploy/{{ include "warp.fullname" . }} -- \
+    warp create-account --username admin --admin
+
+{{- if not .Values.ingress.enabled }}
+
+Reach it locally:
+
+  kubectl port-forward -n {{ .Release.Namespace }} svc/{{ include "warp.fullname" . }} 8008:{{ .Values.service.port }}
+  curl http://localhost:8008/_matrix/client/versions
+{{- end }}
+
+The signing key {{ if .Values.signingKey.existingSecret }}comes from the secret {{ .Values.signingKey.existingSecret }}{{ else }}is on the data volume, which is kept when the release is deleted{{ end }}.
+Losing it means other servers no longer recognise this one.

deploy/helm/warp/templates/_helpers.tpl

@@ -0,0 +1,46 @@
+{{/* Names and labels shared by the templates. */}}
+
+{{- define "warp.name" -}}
+{{- .Chart.Name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "warp.fullname" -}}
+{{- if contains .Chart.Name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "warp.labels" -}}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" }}
+{{ include "warp.selectorLabels" . }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+
+{{- define "warp.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "warp.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{/* The database connection string, defaulted per driver onto the data volume. */}}
+{{- define "warp.connectionString" -}}
+{{- if .Values.database.connectionString -}}
+{{- .Values.database.connectionString -}}
+{{- else if eq .Values.database.driver "sqlite" -}}
+file:/data/warp.db?_pragma=journal_mode(WAL)&_pragma=busy_timeout(10000)&_pragma=foreign_keys(1)
+{{- else if eq .Values.database.driver "pocketbase" -}}
+/data/pb_data
+{{- else -}}
+{{- fail "database.connectionString or database.existingSecret is required for postgres" -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "warp.signingKeyPath" -}}
+{{- if .Values.signingKey.existingSecret -}}
+/etc/warp/keys/{{ .Values.signingKey.existingSecretKey }}
+{{- else -}}
+/data/signing.key
+{{- end -}}
+{{- end -}}

deploy/helm/warp/templates/deployment.yaml

@@ -0,0 +1,166 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "warp.fullname" . }}
+  labels:
+    {{- include "warp.labels" . | nindent 4 }}
+spec:
+  # One homeserver is one process; see values.yaml.
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      {{- include "warp.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "warp.selectorLabels" . | nindent 8 }}
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      {{- if not .Values.signingKey.existingSecret }}
+      initContainers:
+        # Creates the signing key on first start; a key already on the
+        # volume is left alone.
+        - name: signing-key
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command: ["/bin/sh", "-c", "test -f /data/signing.key || warp generate-keys --output /data/signing.key"]
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          volumeMounts:
+            - name: data
+              mountPath: /data
+      {{- end }}
+      containers:
+        - name: warp
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          args: ["serve"]
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          ports:
+            - name: http
+              containerPort: 8008
+              protocol: TCP
+          env:
+            - name: WARP_SERVER_NAME
+              value: {{ required "serverName is required" .Values.serverName | quote }}
+            - name: WARP_WELL_KNOWN_CLIENT_BASE_URL
+              value: {{ .Values.publicBaseURL | quote }}
+            - name: WARP_LISTEN_ADDRESS
+              value: ":8008"
+            - name: WARP_PRIVATE_KEY
+              value: {{ include "warp.signingKeyPath" . | quote }}
+            - name: WARP_DB_DRIVER
+              value: {{ .Values.database.driver | quote }}
+            - name: WARP_DB_CONNECTION_STRING
+              {{- if .Values.database.existingSecret }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.database.existingSecret }}
+                  key: {{ .Values.database.existingSecretKey }}
+              {{- else if eq .Values.database.driver "postgres" }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "warp.fullname" . }}-database
+                  key: connection-string
+              {{- else }}
+              value: {{ include "warp.connectionString" . | quote }}
+              {{- end }}
+            - name: WARP_DB_MAX_OPEN_CONNS
+              value: {{ .Values.database.maxOpenConns | quote }}
+            - name: WARP_MEDIA_BASE_PATH
+              value: /data/media
+            - name: WARP_REGISTRATION_ENABLED
+              value: {{ .Values.registration.enabled | quote }}
+            - name: WARP_FEDERATION_ENABLED
+              value: {{ .Values.federation.enabled | quote }}
+            - name: WARP_METRICS_ENABLED
+              value: {{ .Values.metrics.enabled | quote }}
+            - name: WARP_TRACING_ENABLED
+              value: {{ .Values.tracing.enabled | quote }}
+            {{- with .Values.tracing.endpoint }}
+            - name: WARP_TRACING_ENDPOINT
+              value: {{ . | quote }}
+            {{- end }}
+            - name: WARP_TRACING_SAMPLE_RATIO
+              value: {{ .Values.tracing.sampleRatio | quote }}
+            - name: WARP_LOG_FORMAT
+              value: json
+            {{- with .Values.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          {{- with .Values.extraEnvFrom }}
+          envFrom:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          startupProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            # Migrations run before the server listens; a large database
+            # takes a while on the first start after an upgrade.
+            failureThreshold: 60
+            periodSeconds: 5
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            periodSeconds: 30
+            timeoutSeconds: 5
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            periodSeconds: 10
+            timeoutSeconds: 5
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            - name: data
+              mountPath: /data
+            - name: tmp
+              mountPath: /tmp
+            {{- if .Values.signingKey.existingSecret }}
+            - name: signing-key
+              mountPath: /etc/warp/keys
+              readOnly: true
+            {{- end }}
+      volumes:
+        - name: data
+          {{- if .Values.persistence.enabled }}
+          persistentVolumeClaim:
+            claimName: {{ .Values.persistence.existingClaim | default (printf "%s-data" (include "warp.fullname" .)) }}
+          {{- else }}
+          emptyDir: {}
+          {{- end }}
+        - name: tmp
+          emptyDir: {}
+        {{- if .Values.signingKey.existingSecret }}
+        - name: signing-key
+          secret:
+            secretName: {{ .Values.signingKey.existingSecret }}
+            defaultMode: 0400
+        {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

deploy/helm/warp/templates/ingress.yaml

@@ -0,0 +1,35 @@
+{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "warp.fullname" . }}
+  labels:
+    {{- include "warp.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with .Values.ingress.className }}
+  ingressClassName: {{ . }}
+  {{- end }}
+  {{- with .Values.ingress.tls }}
+  tls:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ include "warp.fullname" $ }}
+                port:
+                  name: http
+          {{- end }}
+    {{- end }}
+{{- end }}

deploy/helm/warp/templates/pvc.yaml

@@ -0,0 +1,20 @@
+{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "warp.fullname" . }}-data
+  labels:
+    {{- include "warp.labels" . | nindent 4 }}
+  annotations:
+    # The signing key lives here: deleting the release must not delete it.
+    helm.sh/resource-policy: keep
+spec:
+  accessModes:
+    {{- toYaml .Values.persistence.accessModes | nindent 4 }}
+  {{- with .Values.persistence.storageClass }}
+  storageClassName: {{ . | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size }}
+{{- end }}

deploy/helm/warp/templates/secret.yaml

@@ -0,0 +1,11 @@
+{{- if and (not .Values.database.existingSecret) (eq .Values.database.driver "postgres") }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "warp.fullname" . }}-database
+  labels:
+    {{- include "warp.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+  connection-string: {{ include "warp.connectionString" . | quote }}
+{{- end }}

deploy/helm/warp/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "warp.fullname" . }}
+  labels:
+    {{- include "warp.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - name: http
+      port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+  selector:
+    {{- include "warp.selectorLabels" . | nindent 4 }}

deploy/helm/warp/templates/servicemonitor.yaml

@@ -0,0 +1,19 @@
+{{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ include "warp.fullname" . }}
+  labels:
+    {{- include "warp.labels" . | nindent 4 }}
+    {{- with .Values.metrics.serviceMonitor.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  selector:
+    matchLabels:
+      {{- include "warp.selectorLabels" . | nindent 6 }}
+  endpoints:
+    - port: http
+      path: /metrics
+      interval: {{ .Values.metrics.serviceMonitor.interval }}
+{{- end }}

deploy/helm/warp/values.yaml

@@ -0,0 +1,134 @@
+# Default values for the Warp chart.
+#
+# Warp is a monolith: one replica holds the whole homeserver, and a second
+# one would be a second homeserver with the same name. The deployment
+# therefore runs exactly one pod and replaces it with the Recreate
+# strategy, never two at once.
+
+# There is no published image: build one with `make docker` (or
+# `docker build -t <registry>/warp:<tag> .`) and push it to a registry the
+# cluster can pull from.
+image:
+  repository: warp
+  # Defaults to the chart's appVersion.
+  tag: ""
+  pullPolicy: IfNotPresent
+
+imagePullSecrets: []
+
+# The Matrix server name: the part after the colon in @user:example.org.
+# It cannot be changed once users and rooms exist.
+serverName: example.org
+
+# The URL clients reach the server at, served in /.well-known/matrix/client
+# and in login responses. Usually the ingress host over https.
+publicBaseURL: https://matrix.example.org
+
+registration:
+  enabled: false
+
+federation:
+  enabled: false
+
+database:
+  # sqlite, postgres or pocketbase.
+  driver: sqlite
+  # The connection string. For sqlite and pocketbase the defaults put the
+  # database on the data volume; for postgres, set it here or, better,
+  # through existingSecret.
+  connectionString: ""
+  # A secret holding the connection string under existingSecretKey,
+  # instead of connectionString.
+  existingSecret: ""
+  existingSecretKey: connection-string
+  maxOpenConns: 20
+
+# The ed25519 signing key. Other servers know this server by it, so it must
+# survive the pod: by default it is created on first start on the data
+# volume. To manage it yourself, put a key made with `warp generate-keys`
+# into a secret and name it here.
+signingKey:
+  existingSecret: ""
+  existingSecretKey: signing.key
+
+# The data volume: the signing key, and the sqlite or pocketbase database
+# and the media store when those are on local disk.
+persistence:
+  enabled: true
+  # Use an existing claim instead of creating one.
+  existingClaim: ""
+  storageClass: ""
+  accessModes: [ReadWriteOnce]
+  size: 20Gi
+
+metrics:
+  enabled: true
+  # A prometheus-operator ServiceMonitor for /metrics.
+  serviceMonitor:
+    enabled: false
+    interval: 30s
+    labels: {}
+
+tracing:
+  enabled: false
+  # The OTLP/HTTP collector, e.g. http://otel-collector.observability:4318.
+  endpoint: ""
+  sampleRatio: 1
+
+# Any other WARP_* setting, as plain environment variables. Every field of
+# warp.yaml.example has one.
+extraEnv: []
+#  - name: WARP_LOG_LEVEL
+#    value: debug
+
+# Further environment from secrets or config maps.
+extraEnvFrom: []
+
+service:
+  type: ClusterIP
+  port: 8008
+
+ingress:
+  enabled: false
+  className: ""
+  annotations: {}
+  # Long polls hold a request open for up to 30 seconds; a proxy with a
+  # shorter read timeout cuts them off. For ingress-nginx:
+  #   nginx.ingress.kubernetes.io/proxy-read-timeout: "90"
+  #   nginx.ingress.kubernetes.io/proxy-body-size: "50m"
+  hosts:
+    - host: matrix.example.org
+      paths:
+        - path: /_matrix
+          pathType: Prefix
+        - path: /.well-known/matrix
+          pathType: Prefix
+        - path: /_warp
+          pathType: Prefix
+  tls: []
+  #  - secretName: matrix-tls
+  #    hosts: [matrix.example.org]
+
+resources:
+  requests:
+    cpu: 100m
+    memory: 256Mi
+  limits:
+    memory: 2Gi
+
+podSecurityContext:
+  runAsUser: 10001
+  runAsGroup: 10001
+  fsGroup: 10001
+  runAsNonRoot: true
+
+securityContext:
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: true
+  capabilities:
+    drop: [ALL]
+
+podAnnotations: {}
+nodeSelector: {}
+tolerations: []
+affinity: {}