apiVersion: apps/v1
kind: Deployment
metadata:
  name: compliant
  namespace: my-namespace
  annotations:
    team: database
spec:
  replicas: 1
  minReadySeconds: 15
  selector:
    matchLabels:
      app: compliant
  strategy:
    type: Recreate
  template:
    metadata:
      namespace: my-namespace
      labels:
        app: compliant
    spec:
      serviceAccountName: my-service-account
      containers:
        - image: nginx:1.20
          name: nginx
          securityContext:
            runAsNonRoot: true
            readOnlyRootFilesystem: true
          resources:
            requests:
              memory: "1Gi"
              cpu: "1"
            limits:
              memory: "4Gi"
              cpu: "2"
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-service-account
  namespace: my-namespace
  labels:
    app.kubernetes.io/name: my-app
  annotations:
    team: database