Run Mosquitto with its non-root image user

chart/mosquitto/templates/resources.yaml

@@ -19,6 +19,11 @@ spec:
       labels: {app: mosquitto}
     spec:
       automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1883
+        runAsGroup: 1883
+        seccompProfile: {type: RuntimeDefault}
       containers:
       - name: mosquitto
         image: {{ printf "%s:%s" .Values.image.repository .Values.image.tag | quote }}

test.sh

@@ -8,3 +8,5 @@ trap 'rm -f "$rendered"' EXIT
 helm template mosquitto "$chart" > "$rendered"
 grep -q '^kind: Deployment$' "$rendered"
 grep -q '^kind: Service$' "$rendered"
+grep -q 'runAsNonRoot: true' "$rendered"
+grep -q 'runAsUser: 1883' "$rendered"