update examples

examples/demo/security_context/busybox.yaml

@@ -1,26 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: psp-demo
-  labels:
-    app.type: prod
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: psp
-  template:
-    metadata:
-      labels:
-        app: psp
-    spec:
-      volumes:
-      - name: sec-ctx-vol
-        emptyDir: {}
-      containers:
-      - name: sec-ctx-demo
-        image: busybox
-        command: [ "sh", "-c", "sleep 1h" ]
-        volumeMounts:
-        - name: sec-ctx-vol
-          mountPath: /data/demo

examples/demo/security_context/nginx.yaml

@@ -0,0 +1,45 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: psp-demo
+  labels:
+    app.type: prod
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: psp
+  template:
+    metadata:
+      labels:
+        app: psp
+    spec:
+      containers:
+      - name: sec-ctx
+        image: nginx
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: psp-demo-unprivileged
+  labels:
+    app.type: prod
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: psp
+  template:
+    metadata:
+      labels:
+        app: psp
+    spec:
+      volumes:
+      - name: sec-ctx-vol
+        emptyDir: {}
+      containers:
+      - name: sec-ctx-unprivileged
+        image: nginxinc/nginx-unprivileged
+        volumeMounts:
+        - name: sec-ctx-vol
+          mountPath: /data/demo

examples/demo/security_context/policy.yaml

@@ -17,5 +17,4 @@ spec:
           template:
             spec:
               securityContext:
-                runAsUser: 1000
-                fsGroup: 2000
+                runAsNonRoot: true