feat(dns): Run with PSS restricted recommendations

apps/k8s01/dns/dns.yaml

@@ -49,6 +49,10 @@ spec:
             - name: tls-secret
               mountPath: "/etc/pki/dnsproxy"
               readOnly: true
+          securityContext:
+            capabilities:
+              drop:
+                - ALL
       automountServiceAccountToken: false
       volumes:
         - name: tls-secret
@@ -56,6 +60,8 @@ spec:
             secretName: ingress-dns-tls
             optional: false
       securityContext:
+        allowPrivilegeEscalation: false
+        unAsNonRoot: true
         seccompProfile:
           type: RuntimeDefault
         sysctls: