apiVersion: apps/v1
kind: Deployment
metadata:
  name: test
  namespace: test
  labels:
    app: test
    owner: jimmy
    canremove: "true"
spec:
  selector:
    matchLabels:
      app: test
  replicas: 1
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 5
      maxUnavailable: 1
  template:
    metadata:
      labels:
        app: test
        owner: jimmy
        env: dev
    spec: 
      containers:
      - name: test
        image: <IMAGE_URL>
        imagePullPolicy: Always
        securityContext:  
          allowPrivilegeEscalation: false  
          runAsUser: 1000  
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          capabilities:
            drop: ["ALL"]  
          seccompProfile:
            type: "RuntimeDefault"