feat(helm)!: Update chart nginx to 18.2.5

[renovate]

This PR contains the following updates:

Package	Update	Change
nginx (source)	major	15.12.2 -> 18.2.5

---

Release Notes

bitnami/charts (nginx)

v18.2.5

• [bitnami/nginx] Unify seLinuxOptions default value (#​30337)

v18.2.4

• [bitnami/nginx] Release 18.2.4 (#​30017) (c14b4ab), closes #​30017
• Update documentation links to techdocs.broadcom.com (#​29931) (f0d9ad7), closes #​29931

v18.2.3

• [bitnami/nginx] Remove duplicated (and wrong) image in verification (#​29871) (124709a), closes #​29871

v18.2.2

• [bitnami/nginx] Release 18.2.2 (#​29751) (4d4d930), closes #​29751

v18.2.1

• [bitnami/nginx] templates/ingress.yaml: fix wrong www.www tls name (#​29563) (045d9d0), closes #​29563

v18.2.0

• [bitnami/nginx] stream server blocks (#​29491) (89e5604), closes #​29491

v18.1.15

• [bitnami/nginx] Release 18.1.15 (#​29510) (3c8f5ec), closes #​29510

v18.1.14

• [bitnami/nginx] Release 18.1.14 (#​29420) (5c3aa0e), closes #​29420

v18.1.13

• [bitnami/nginx] Release 18.1.13 (#​29390) (1167027), closes #​29390

v18.1.12

• [bitnami/nginx] Release 18.1.12 - bugfix prometheusrules label collision (#​29276) (c44ac28), closes #​29276

v18.1.11

• [bitnami/nginx] Release 18.1.11 (#​28993) (34e0c37), closes #​28993

v18.1.10

• [bitnami/nginx] Release 18.1.10 (#​28959) (83e2fa5), closes #​28959

v18.1.9

• [bitnami/nginx] Release 18.1.9 (#​28886) (1dccc11), closes #​28886

v18.1.8

• [bitnami/nginx] Support for Non-Bitnami Nginx Images in nginx Helm Chart (#​28741) (00a53e4), closes #​28741

v18.1.7

• [bitnami/nginx] Release 18.1.7 (#​28450) (2ffa35e), closes #​28450

v18.1.6

• [bitnami/nginx] Release 18.1.6 (#​28330) (54dc332), closes #​28330

v18.1.5

• [bitnami/nginx] Global StorageClass as default value (#​28070) (7b70f12), closes #​28070

v18.1.4

• [bitnami/nginx] Release 18.1.4 (#​27743) (a9c9841), closes #​27743

v18.1.3

• [bitnami/*] Update README changing TAC wording (#​27530) (52dfed6), closes #​27530
• [bitnami/nginx] Release 18.1.3 (#​27704) (682210e), closes #​27704

v18.1.2

• [bitnami/nginx] Release 18.1.2 (#​27390) (fc21995), closes #​27390

v18.1.1

• [bitnami/nginx] Release 18.1.15 (#​29510) (3c8f5ec), closes #​29510

v18.1.0

• [bitnami/nginx] Allowing for customize dnsPolicy and dnsConfig for nginx (#​26619) (d7f4af3), closes #​26619

v18.0.3

• [bitnami/nginx] Release 18.0.3 (#​27083) (695dc9d), closes #​27083

v18.0.2

• [bitnami/nginx] fix: Revert back use of http port instead of https (#​27040) (1d65098), closes #​27040 #​20934

v18.0.1

• [bitnami/nginx] Release 18.0.1 (#​26994) (e7ac90f), closes #​26994

v18.0.0

• [bitnami/nginx] Release 18.0.0 (#​26900) (1376775), closes #​26900

v17.3.2

• [bitnami/nginx] Release 17.3.2 (#​26550) (97e4026), closes #​26550

v17.3.1

• [bitnami/nginx] Release 17.3.1 (#​26479) (f66f7a4), closes #​26479

v17.3.0

• [bitnami/nginx] PDB review (#​26159) (d91aafc), closes #​26159

v17.2.1

• [bitnami/nginx] Fix readiness probe (#​26394) (0722a57), closes #​26394

v17.2.0

• [bitnami/nginx] Allow custom path for readinessProbe and update startupProbe (#​26362) (24fcc5a), closes #​26362

v17.1.0

• [bitnami/*] ci: 👷 Add tag and changelog support (#​25359) (91c707c), closes #​25359
• [bitnami/nginx] feat: ✨ 🔒 Add warning when original images are replaced (#​26253) (b10be08), closes #​26253
• [bitnami/nginx] Use different liveness/readiness probes (#​25969) (6a52e0d), closes #​25969

v17.0.2

• [bitnami/nginx] Release 17.0.2 updating components versions (#​26055) (667f77e), closes #​26055

v17.0.1

• [bitnami/nginx] Release 17.0.1 updating components versions (#​25801) (c44d0d9), closes #​25801

v17.0.0

• [bitnami/*] Change non-root and rolling-tags doc URLs (#​25628) (b067c94), closes #​25628
• [bitnami/nginx] Release 17.0.0 updating components versions (#​25708) (c43c4bd), closes #​25708

v16.0.7

• [bitnami/*] Set new header/owner (#​25558) (8d1dc11), closes #​25558
• [bitnami/multiple charts] Fix typo: "NetworkPolice" vs "NetworkPolicy" (#​25348) (6970c1b), closes #​25348
• [bitnami/nginx] deployment fail because of OpenShift restricted-v2 issue 25425 (#​25443) (1d37888), closes #​25443
• Replace VMware by Broadcom copyright text (#​25306) (a5e4bd0), closes #​25306

v16.0.6

• [bitnami/nginx] fix git clone initcontainers (#​25287) (3f672c1), closes #​25287

v16.0.5

• [bitnami/nginx] Define by default a https container port now TLS is enabled (#​25091) (189d9e0), closes #​25091

v16.0.4

• [bitnami/nginx] Release 16.0.4 updating components versions (#​25196) (ca970d7), closes #​25196

v16.0.3

• [bitnami/nginx] Fix ternary on probe port name selection (#​25059) (9691580), closes #​25059

v16.0.2

• [bitnami/nginx] fix: correct ternary when tls is enabled (#​25040) (9dd19ed), closes #​25040

v16.0.1

• [bitnami/nginx] Release 16.0.1 updating components versions (#​24962) (2924afe), closes #​24962

v16.0.0

• [bitnami/nginx] feat!: 🔒 💥 Improve security defaults (#​24371) (66f3026), closes #​24371
• Update resourcesPreset comments (#​24467) (92e3e8a), closes #​24467

v15.14.2

• [bitnami/nginx] Release 15.14.2 updating components versions (#​24811) (d742aca), closes #​24811

v15.14.1

• [bitnami/*] Reorder Chart sections (#​24455) (0cf4048), closes #​24455
• [bitnami/nginx] Release 15.14.1 updating components versions (#​24803) (74c6f43), closes #​24803

v15.14.0

• [bitnami/nginx] feat: ✨ 🔒 Add readOnlyRootFilesystem support (#​24041) (668e128), closes #​24041

v15.13.0

• [bitnami/nginx] feat: ✨ 🔒 Add automatic adaptation for Openshift restricted-v2 SCC (#​2 (84c995b), closes #​24130

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Path: cluster/apps/nginx/helmrelease.yaml
Version: 15.12.2 -> 18.2.5

@@ -1,4 +1,37 @@
 ---
+# Source: nginx/templates/pdb.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: nginx
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: nginx
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: nginx
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: nginx
+      app.kubernetes.io/name: nginx
+---
+# Source: nginx/templates/tls-secret.yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: nginx-tls
+  namespace: "default"
+  labels:
+    app.kubernetes.io/instance: nginx
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: nginx
+type: kubernetes.io/tls
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURaRENDQWt5Z0F3SUJBZ0lRQVZUaVBlWWJqQmdRRFhNeHhVdk9QVEFOQmdrcWhraUc5dzBCQVFzRkFEQVQKTVJFd0R3WURWUVFERXdodVoybHVlQzFqWVRBZUZ3MHlOREV4TURneE5UVTVNREZhRncweU5URXhNRGd4TlRVNQpNREZhTUJBeERqQU1CZ05WQkFNVEJXNW5hVzU0TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCCkNnS0NBUUVBeU1tNDErL2lFVUZqaVFyZCt4RXZkVmVXTHI2MWhMVFoxM2tGRDJEbzY5Z2pBWHBnUzNoL0VURFcKVmpnUytOdVhsSW1vSGJSOEJSRDVqWmtnYVpWc3lGVVZia0dMWWo5YUlLNFdWT2M5dVVBYWRlQUcwenFkNzJtMgpTRWR4R1lya1Zkd0NOek9lRXNvWi8vYWNVRExEcnlpZUYza2pLb0Y1VmJoSTZONVUvRlF3UHA1Y0hKSURUcmNJCjFHTDN4ZEgvWGlYV2dzR21nYnA3ZFhIV2gyM1RYZnlob09kMVNYdkQrYmdJVHZwRTF1YzZ4OER0V3FiNnZkQmYKNEo4NzlXVXFGdFoxK2wwNkFGNXFFUE1la0Y4ZHBYbFFXbitSeDF6R0tDZEh5S2x6N0dTS3d2L0FtSmhkZy9YZwo2UFZVOTdFV1JhdFRWNStSWkRyTWFsSzRnK09sblFJREFRQUJvNEcyTUlHek1BNEdBMVVkRHdFQi93UUVBd0lGCm9EQWRCZ05WSFNVRUZqQVVCZ2dyQmdFRkJRY0RBUVlJS3dZQkJRVUhBd0l3REFZRFZSMFRBUUgvQkFJd0FEQWYKQmdOVkhTTUVHREFXZ0JUUGZjc2VrS2FzUVM0eVVOcG9tWUNBa2h3TFRqQlRCZ05WSFJFRVREQktnZ1Z1WjJsdQplSUlOYm1kcGJuZ3VaR1ZtWVhWc2RJSVJibWRwYm5ndVpHVm1ZWFZzZEM1emRtT0NIMjVuYVc1NExtUmxabUYxCmJIUXVjM1pqTG1Oc2RYTjBaWEl1Ykc5allXd3dEUVlKS29aSWh2Y05BUUVMQlFBRGdnRUJBRXBTVWZYM0k2YmYKOXhqeG9BaXdTQmJRYXNsdkh6bmJPRnkzSEZHYmtEajBOamgrNmFETVFkVDlKdWYxQlNaWWpjR0xBems3N3A3cAplbUFUNDdsRW1Ob09lOTNBTmRaNFZGeFV0OWREK0lSTGUrV2t3a1FPdEJqcUtjKzVrN3p4SS9NdmlLTlF0YWRPClBUcVZjOGhzUmY3bkV2cDA3TVB5dDIvOWhobms1TUpDVnlIZUZ2dmE0VC9Sb3NmMnNBdUNBQ3lEb1NPS2lZaU0KQVd2SXIxUW95Qlo4L1VwV09ZU1dvczNKanBrbmZHRnZyTHM5dXVZNTRocGFLNUdGOHhKTDR2VytyVnFEbjYxUQo3bEFuNjJaSXU4WmNtNGkyU1puQUJMWi95cGZZN3UxS1FwcEQzekdkM1ZsaXQ2ajZGcTB3UHVHdFBwbVlRZ3pNClVLNXl6WGV2OWY0PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBeU1tNDErL2lFVUZqaVFyZCt4RXZkVmVXTHI2MWhMVFoxM2tGRDJEbzY5Z2pBWHBnClMzaC9FVERXVmpnUytOdVhsSW1vSGJSOEJSRDVqWmtnYVpWc3lGVVZia0dMWWo5YUlLNFdWT2M5dVVBYWRlQUcKMHpxZDcybTJTRWR4R1lya1Zkd0NOek9lRXNvWi8vYWNVRExEcnlpZUYza2pLb0Y1VmJoSTZONVUvRlF3UHA1YwpISklEVHJjSTFHTDN4ZEgvWGlYV2dzR21nYnA3ZFhIV2gyM1RYZnlob09kMVNYdkQrYmdJVHZwRTF1YzZ4OER0CldxYjZ2ZEJmNEo4NzlXVXFGdFoxK2wwNkFGNXFFUE1la0Y4ZHBYbFFXbitSeDF6R0tDZEh5S2x6N0dTS3d2L0EKbUpoZGcvWGc2UFZVOTdFV1JhdFRWNStSWkRyTWFsSzRnK09sblFJREFRQUJBb0lCQURXbnVpNXlHdjR6ZEE3RwpDYVd5NVBTOWNCT1R3TnZ5bkJmNWJnRzdDdU1qUWM5K1RVYzlydThBRnZhNVMxQ1hGYjJLdjVNWWpOK3B0cFpCCktpa3MxZ0grd3BoUkNaYzZpTEljOHpqREJucC9oOUtpQ0JEZ0pCNDdLSXZPRTRvWTFJV2hJakp3SjdpcnF5RDgKWEs4TnNiOFg0bzh4UHRWMy9kMkxQbWlFS1QrNEltYTlza0JFUmE4eTg1UG5nUTlsN2tMbzNmd2NYYkdtRG1iNQpVMDg1d3BrL3ZwN3lIQVl6U0lQdWJhWUlkNVpWVnJ6T2tmQk5NY2pDNm9OWFlPV1ByK0JxN1NpRWFPR09vQnBuCmJtenAwdjE4TWllZC9aazhFS1NDb3FqM2FhNElYRTcrTlR6TURuS0kxc0ZGZTF3YlM2Z0QrcTQ0Ukx2aG1ET1oKdU9kYllNRUNnWUVBM0JPeWI0YzVXRXpyUmQyb2lkTDZUUHhMeEdoUGNqMjgrQ3N3M2V6WC9RcUJ1Wmg5S3F1UApNZDhOaGFXOGtCWmRXM1V5anUzaW16V3p6MWphWEg0NFRYMjJzR0NHcm1oTURJT0p4T1Uwc2I3QUFLVnBhYUorCnJ2bDFBSVpWZHBJdzhsdWF5enk4NncyM1ZvMlZCVytqK0dVSmhKai9jVGpyZWhzWElLNEtJcEVDZ1lFQTZaQUEKYXhYcWhqVVVpQ1RyUkkxN3hWOTdYVFdkaFBER2VmYW91VGFnM0kyWVdTMnh2a2hHUVNtcUpxNEJOWHFGVTBEZworaTJ3a0o1ZE52YS9rQzRRUTFneDhxa3RxVG1BbWtKaXQyQ3pEZjRZU2JQRTBoblNTNzFDUm1OS091NGxsaW1HClVBd0tTeFozQVNPTU5vcUtrY01jRDFvZFptOHdrSXlDNTlLRFFFMENnWUVBcTNjNVBnWFlXd0RMQ2dzeVJmZTQKQm9WSHJ3WXFaL0xNS1hyVlB3TktJUit2aE4vWEhZaS9MM2IrL1JMdFFFSDhpTVplRnRnbkJ4Q25RTFNVcFIyKwpWam5OUGN4bkFybkdEclhwZ0J1b201Zm4xbGtLTVVCbWZZTmtjbjAzVndOOTJVWWY2NXN1QWVFVTUvMjFqcCsxCjNGRTBRamhHUlh1NGs5RkppcSt1dTlFQ2dZQkpmeTRTaEpnRFdZcTNlTjZyK05XOCsxbm5yK3A4bmdQbTkwNksKMGZ6MnludnBmQzZWa1VyQ1VLa2hlTm9haVE2UmJ6WWNvK29PNkRhdkNDQ3A3MFRnM0UwRGJtZFcvQ2hTNHBjTAoyNXNjeVJ1OWZadHUvZjhtSkUxSnR3N3gwbVR6aHVla0l0WE9ZU2hickdMLytzSzJNYTZQeWl5OFFqc0hFYUJUCjhQT3FkUUtCZ0VnNXlZclZEZG5QOHpnRThjS0ZEUStvVjdyVkFnaFJSKzFRem1Vc1pYaDdhVm95dUhzVzBwUU4KbUE5YjJDam0wMjgvaEg4VzcwaXlkOFFiaWM4cWlQU0NPM0EyUXdtdTlMUzVDZFNGa2lqVjNwS3RIYmtVRDQ4VgorSWNoMUJLVnFmRk5uc3NpMS85TC9FNk0zTnBqbG9VY0lqZTdMS0xJdkw1L0s3RmJMMHpuCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
+  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFVENDQWZtZ0F3SUJBZ0lRWXRMb1pEZERhckVKc05LTktmR1JHakFOQmdrcWhraUc5dzBCQVFzRkFEQVQKTVJFd0R3WURWUVFERXdodVoybHVlQzFqWVRBZUZ3MHlOREV4TURneE5UVTVNREJhRncweU5URXhNRGd4TlRVNQpNREJhTUJNeEVUQVBCZ05WQkFNVENHNW5hVzU0TFdOaE1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBCk1JSUJDZ0tDQVFFQXFHNW1ydUtKdmZCRlN6aTEwRWpucEw5M0JkNTl3U283Q1poVEhmN0tlQXFtdTNKYlJWTE0KQ29CUmR2N1RHNFdpbUIyUjR1aUVPZEMrcnVMdWtSMVAyTEJBOFljRURhZ1MzTUY1UmdQN09XS2xVZklERjdiZAo5VWJ1VExKbWJaYUxLRVpyTUFKQjRwQmEyZy9keUFoUU5PdGNGWGJRcDZBQVpCQmNhcmsxbmhLcTJIR3AyRENuCm8rSWhnVlVuL0RxSFVzdzk5Wi9vSVViU2hDQjQyQTRPTHNOeG42V21VZUZqK3B1Nmlrb3NKSDFRSGVqSHJ2ZWQKeXMyNTlSNnFmZGU1RlYxV0lpNXJLR3AvRkpkQlB0M3k1TEVuNEkxTVpxbGRWL2VXVHpSb3VoZXRPMGpBbkcrbgplOWlmTVRvem0vM2lPVG5pWlBldlBYQUsrUWlkSEpwN1B3SURBUUFCbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DCkFxUXdIUVlEVlIwbEJCWXdGQVlJS3dZQkJRVUhBd0VHQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUIKQWY4d0hRWURWUjBPQkJZRUZNOTl5eDZRcHF4QkxqSlEybWlaZ0lDU0hBdE9NQTBHQ1NxR1NJYjNEUUVCQ3dVQQpBNElCQVFCU2kwUVU1WklxcVl6b1YvdUhwQjhVMkNDalhYRHRZdVp0bksyUjFiUTVvM1RKa20wcW5jcG8zWWR6Cmx5TXJVKzYwdk40T2FkZlQ1ZVNJNndmT3ZGV1NuRTAxdzhmSWJBTld2UGNTa0ZnWXVsZG9ScjdXNjlhZTV5RUwKVWxha0toTE5ldCtYQVpoQTFKTkxkOTNlRFJ4OVFrVXd2Z2VQanZmN0RRWVVrc2NQczFXSW5ZbXVRVXdUM1REUApRUXgyRFYwamlHclZrNndwUDZRRHh6eCtqaXpvWkNsakViZDIrVFpVKzZtbjFOOVRkWkhFMTExdVJiUGVRMml0CkdxKzJ3MDFzclpRY2pJT09WUzB4UVlNWGpXVlJndzdjS3FuM0YyNkdRNU5aTFZmc3pqV1ppNlUrK3phdmc4b0YKQXRxNmljWUhzNGthR1dCaHRnb3Z2Z0k2U2dTdwotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+---
 # Source: nginx/templates/server-block-configmap.yaml
 apiVersion: v1
 kind: ConfigMap
@@ -52,6 +85,9 @@
     - name: http
       port: 80
       targetPort: http
+    - name: https
+      port: 443
+      targetPort: https
   selector:
     app.kubernetes.io/instance: nginx
     app.kubernetes.io/name: nginx
@@ -83,7 +119,7 @@
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: nginx
       annotations:
-        checksum/server-block-configuration: 500dd08aaf2d81d263307fbc091e1943e2134dc864cc6aa38ddcef58ac9a7648
+        checksum/server-block-configuration: 12463197f1d04ffd8474761451a1e44734d8bf6f7c4d2f873dcfac8f38e385ac
     spec:
       shareProcessNamespace: false
       serviceAccountName: default
@@ -108,8 +144,44 @@
         supplementalGroups: []
         sysctls: []
       initContainers:
+        - name: preserve-logs-symlinks
+          image: public.ecr.aws/bitnami/nginx:1.25.4
+          imagePullPolicy: "IfNotPresent"
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
+            readOnlyRootFilesystem: true
+            runAsGroup: 1001
+            runAsNonRoot: true
+            runAsUser: 1001
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
+          resources:
+            limits:
+              memory: 300Mi
+            requests:
+              cpu: 100m
+              memory: 100Mi
+          command:
+            - /bin/bash
+          args:
+            - -ec
+            - |
+              #!/bin/bash
+              . /opt/bitnami/scripts/libfs.sh
+              # We copy the logs folder because it has symlinks to stdout and stderr
+              if ! is_dir_empty /opt/bitnami/nginx/logs; then
+                cp -r /opt/bitnami/nginx/logs /emptydir/app-logs-dir
+              fi
+          volumeMounts:
+            - name: empty-dir
+              mountPath: /emptydir
         - name: git-clone-repository
-          image: docker.io/bitnami/git:2.43.2-debian-12-r2
+          image: docker.io/bitnami/git:2.47.0-debian-12-r0
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
@@ -117,10 +189,11 @@
               drop:
                 - ALL
             privileged: false
-            readOnlyRootFilesystem: false
+            readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
-            seLinuxOptions: null
+            seLinuxOptions: {}
             seccompProfile:
               type: RuntimeDefault
           command:
@@ -131,6 +204,15 @@
               git clone https://github.com/npawelek/firmware.git --branch main /tmp/app
               [[ "$?" -eq 0 ]] && shopt -s dotglob && rm -rf /app/* && mv /tmp/app/* /app/
           volumeMounts:
+            - name: empty-dir
+              mountPath: /tmp
+              subPath: tmp-dir
+            - name: empty-dir
+              mountPath: /etc/ssh
+              subPath: etc-ssh-dir
+            - name: empty-dir
+              mountPath: /.ssh
+              subPath: ssh-dir
             - name: staticsite
               mountPath: /app
           env:
@@ -138,7 +220,7 @@
               value: /tmp
       containers:
         - name: git-repo-syncer
-          image: docker.io/bitnami/git:2.43.2-debian-12-r2
+          image: docker.io/bitnami/git:2.47.0-debian-12-r0
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
@@ -146,10 +228,11 @@
               drop:
                 - ALL
             privileged: false
-            readOnlyRootFilesystem: false
+            readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
-            seLinuxOptions: null
+            seLinuxOptions: {}
             seccompProfile:
               type: RuntimeDefault
           command:
@@ -163,7 +246,25 @@
                   cd /app && git pull origin main
                   sleep 60
               done
+          resources:
+            limits:
+              cpu: 150m
+              ephemeral-storage: 2Gi
+              memory: 192Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
           volumeMounts:
+            - name: empty-dir
+              mountPath: /tmp
+              subPath: tmp-dir
+            - name: empty-dir
+              mountPath: /etc/ssh
+              subPath: etc-ssh-dir
+            - name: empty-dir
+              mountPath: /.ssh
+              subPath: ssh-dir
             - name: staticsite
               mountPath: /app
           env:
@@ -178,10 +279,11 @@
               drop:
                 - ALL
             privileged: false
-            readOnlyRootFilesystem: false
+            readOnlyRootFilesystem: true
+            runAsGroup: 1001
             runAsNonRoot: true
             runAsUser: 1001
-            seLinuxOptions: null
+            seLinuxOptions: {}
             seccompProfile:
               type: RuntimeDefault
           env:
@@ -189,12 +291,16 @@
               value: "false"
             - name: NGINX_HTTP_PORT_NUMBER
               value: "8080"
+            - name: NGINX_HTTPS_PORT_NUMBER
+              value: "8443"
             - name: TZ
               value: America/Chicago
           envFrom:
           ports:
             - name: http
               containerPort: 8080
+            - name: https
+              containerPort: 8443
           livenessProbe:
             failureThreshold: 6
             initialDelaySeconds: 30
@@ -209,7 +315,8 @@
             periodSeconds: 5
             successThreshold: 1
             timeoutSeconds: 3
-            tcpSocket:
+            httpGet:
+              path: /
               port: http
           resources:
             limits:
@@ -218,11 +325,35 @@
               cpu: 100m
               memory: 100Mi
           volumeMounts:
+            - name: empty-dir
+              mountPath: /tmp
+              subPath: tmp-dir
+            - name: empty-dir
+              mountPath: /opt/bitnami/nginx/conf
+              subPath: app-conf-dir
+            - name: empty-dir
+              mountPath: /opt/bitnami/nginx/logs
+              subPath: app-logs-dir
+            - name: empty-dir
+              mountPath: /opt/bitnami/nginx/tmp
+              subPath: app-tmp-dir
             - name: nginx-server-block
               mountPath: /opt/bitnami/nginx/conf/server_blocks
             - name: staticsite
               mountPath: /app
+            - name: certificate
+              mountPath: /certs
       volumes:
+        - name: empty-dir
+          emptyDir: {}
+        - name: certificate
+          secret:
+            secretName: nginx-tls
+            items:
+              - key: tls.crt
+                path: server.crt
+              - key: tls.key
+                path: server.key
         - name: nginx-server-block
           configMap:
             name: nginx-server-block