Secure elasticsearch StatefulSet for kubernetes / Helm

kustomization.yaml

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- all.yaml
patchesStrategicMerge:
- |-
  apiVersion: apps/v1
  kind: StatefulSet
  metadata:
    name: djobi-metrics-es
  spec:
    template:
      spec:
        initContainers:
        - name: keystore
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 1000
patchesJson6902:
- target:
    group: apps
    version: v1
    kind: StatefulSet
    name: djobi-metrics-es
  patch: |-
    - op: add
      path: /spec/template/spec/volumes/-
      value:
        name: keystore-es-config
        emptyDir: {}
    - op: add
      path: /spec/template/spec/volumes/-
      value:
        name: common-tmp
        emptyDir: {}
    - op: add
      path: /spec/template/spec/volumes/-
      value:
        name: elasticsearch-logs
        emptyDir: {}
    - op: add
      path: /spec/template/spec/initContainers/0/volumeMounts/-
      value:
        name: keystore-es-config
        mountPath: /usr/share/elasticsearch/config
    - op: add
      path: /spec/template/spec/initContainers/0/volumeMounts/-
      value:
        name: common-tmp
        mountPath: /tmp
    - op: add
      path: /spec/template/spec/containers/0/volumeMounts/-
      value:
        name: common-tmp
        mountPath: /tmp
    - op: add
      path: /spec/template/spec/containers/0/volumeMounts/-
      value:
        name: elasticsearch-logs
        mountPath: /usr/share/elasticsearch/logs