{{- end }}
      {{- with .Values.postJob.tolerations }}
      tolerations: {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- if .Values.postJob.securityContext.enabled }}
      securityContext: {{ omit .Values.postJob.securityContext "enabled" | toYaml | nindent 12 }}
      {{- end }}
      volumes:
        - name: etc-path
          emptyDir: {}
        - name: tmp
          emptyDir: {}

nodeSelector: {}
tolerations: []
affinity: {}
topologySpreadConstraints: []

## Add stateful containers to have security context, if enabled MinIO will run as this
## user and group NOTE: securityContext is only enabled if persistence.enabled=true
securityContext:
  enabled: true
  runAsUser: 1000
  runAsGroup: 1000
  fsGroup: 1000
  fsGroupChangePolicy: "OnRootMismatch"

containerSecurityContext:
  readOnlyRootFilesystem: false

      {{- end }}
      {{- if .Values.runtimeClassName }}
      runtimeClassName: "{{ .Values.runtimeClassName }}"
      {{- end }}
      {{- if and .Values.securityContext.enabled .Values.persistence.enabled }}
      securityContext:
        {{ omit .Values.securityContext "enabled" | toYaml | nindent 8 }}
      {{- end }}
      {{ if .Values.serviceAccount.create }}
      serviceAccountName: {{ .Values.serviceAccount.name }}

			pod.Spec.Containers[1].Env = tt.proxyEnv

			pod.Spec.Containers[1].SecurityContext = &corev1.SecurityContext{}

			if tt.customGID != nil {
				pod.Spec.Containers[1].SecurityContext.RunAsGroup = tt.customGID
			}

			if tt.customUID != nil {
				pod.Spec.Containers[1].SecurityContext.RunAsUser = tt.customUID
			}

      {{- end }}
      {{- if .Values.runtimeClassName }}
      runtimeClassName: "{{ .Values.runtimeClassName }}"
      {{- end }}
      {{- if and .Values.securityContext.enabled .Values.persistence.enabled }}
      securityContext:
        {{- omit .Values.securityContext "enabled" | toYaml | nindent 8 }}
      {{- end }}
      {{- if .Values.serviceAccount.create }}
      serviceAccountName: {{ .Values.serviceAccount.name }}

			for _, e := range c.Env {
				pi.ProxyEnvironments[e.Name] = e.Value
			}
			if len(c.Args) >= 2 && c.Args[0] == "proxy" {
				pi.ProxyType = c.Args[1]
			}
			if c.SecurityContext != nil {
				pi.ProxyUID = c.SecurityContext.RunAsUser
				pi.ProxyGID = c.SecurityContext.RunAsGroup
			}
		}
	}
	return pi
}

// containers fetches all containers in the pod.

.Values.priorityClassName }} priorityClassName: "{{ .Values.priorityClassName }}" {{- end }} {{- if .Values.runtimeClassName }} runtimeClassName: "{{ .Values.runtimeClassName }}" {{- end }} {{- if and .Values.securityContext.enabled .Values.persistence.enabled }} securityContext: {{ omit .Values.securityContext "enabled" | toYaml | nindent 8 }} {{- end }} {{ if .Values.serviceAccount.create }} serviceAccountName: {{ .Values.serviceAccount.name }} {{- end }} containers: - name: {{ .Chart.Name }} image: "{{ ...

  GF_AUTH_BASIC_ENABLED: "false"
  GF_AUTH_ANONYMOUS_ENABLED: "true"
  GF_AUTH_ANONYMOUS_ORG_ROLE: Admin

# Expose on port 3000 to match the Istio docs
service:
  port: 3000

securityContext: null

# Set up out dashboards
dashboardProviders:
  dashboardproviders.yaml:
    apiVersion: 1
    providers:
      - name: "istio"
        orgId: 1
        folder: "istio"
        type: file

		// Ref: https://istio.io/latest/docs/ops/deployment/requirements/#pod-requirements
		if container.Name != "istio-proxy" && container.Name != "istio-operator" {
			if container.SecurityContext != nil && container.SecurityContext.RunAsUser != nil {
				if *container.SecurityContext.RunAsUser == UserID {
					fmt.Fprintf(writer, "WARNING: User ID (UID) 1337 is reserved for the sidecar proxy.\n")
				}
			}
		}
	}

serviceAnnotations | [service annotations](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
securityContext | [security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod)

These K8s setting are available for each component under the `k8s` field, for example: