CHANGELOG.md

@@ -2,6 +2,10 @@
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.7.6-bb.2]
+### Changed
+- Updated default containerSecurityContext for `monolith`
+
 ## [1.7.6-bb.1]
 ### Added
 - Added appVersion annotation to Chart.yaml

README.md

 # loki-simple-scalable
 
-![Version: 1.7.6-bb.1](https://img.shields.io/badge/Version-1.7.6--bb.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.6.1](https://img.shields.io/badge/AppVersion-2.6.1-informational?style=flat-square)
+![Version: 1.7.6-bb.2](https://img.shields.io/badge/Version-1.7.6--bb.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.6.1](https://img.shields.io/badge/AppVersion-2.6.1-informational?style=flat-square)
 
 Helm chart for Grafana Loki in simple, scalable mode
 
@@ -276,6 +276,8 @@ helm install loki-simple-scalable chart/
 | monolith.extraPorts[1] | object | `{"name":"tcp-memberlist","port":7946,"protocol":"TCP"}` | Extra ports for loki pods. Additional ports exposed to support memberlist |
 | monolith.nameOverride | string | `"loki"` |  |
 | monolith.fullnameOverride | string | `"loki"` |  |
+| monolith.containerSecurityContext.readOnlyRootFilesystem | bool | `true` |  |
+| monolith.containerSecurityContext.capabilities.drop[0] | string | `"ALL"` |  |
 | monolith.service.labels.app | string | `"loki"` |  |
 | monolith.service.labels.release | string | `"logging-loki"` |  |
 | monolith.readinessProbe.initialDelaySeconds | int | `80` |  |

chart/Chart.yaml

@@ -3,7 +3,7 @@ name: loki-simple-scalable
 description: Helm chart for Grafana Loki in simple, scalable mode
 type: application
 appVersion: 2.6.1
-version: 1.7.6-bb.1
+version: 1.7.6-bb.2
 home: https://grafana.github.io/helm-charts
 sources:
   - https://github.com/grafana/loki

chart/values.yaml

@@ -1058,6 +1058,13 @@ monolith:
   nameOverride: loki
   fullnameOverride: loki
 
+  # set more restrictive container security context
+  containerSecurityContext:
+    readOnlyRootFilesystem: true
+    capabilities:
+      drop:
+        - ALL
+
   #Required for monolith ServiceMonitor template 
   service:
     labels: