phase 14-15: docker build validation and helm deployment

infra/k8s/aggregation-worker.yaml

@@ -6,6 +6,7 @@ metadata:
   labels:
     app: aggregation-worker
     app.kubernetes.io/part-of: stonks-oracle
+    stonks-oracle/tier: processing
 spec:
   replicas: 1
   selector:
@@ -15,16 +16,30 @@ spec:
     metadata:
       labels:
         app: aggregation-worker
+        stonks-oracle/tier: processing
     spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
       containers:
         - name: aggregation-worker
           image: ghcr.io/celesrenata/stonks-oracle/aggregation:latest
           imagePullPolicy: Always
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
           envFrom:
             - configMapRef:
                 name: stonks-config
             - secretRef:
-                name: stonks-secrets
+                name: stonks-core-secrets
           resources:
             requests:
               cpu: 100m
@@ -32,3 +47,10 @@ spec:
             limits:
               cpu: 500m
               memory: 256Mi
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: tmp
+          emptyDir:
+            sizeLimit: 10Mi