feat: enabled monitors everywhere and standardize resources a bit (#1281)

* feat: enabled monitors everywhere and standardize resources a bit

Signed-off-by: Devin Buhl <devin@buhl.casa>

* add raw tags

---------

Signed-off-by: Devin Buhl <devin@buhl.casa>

bootstrap/templates/kubernetes/apps/network/cloudflared/app/helmrelease.yaml.j2

@@ -35,7 +35,7 @@ spec:
               repository: docker.io/cloudflare/cloudflared
               tag: 2024.1.5
             env:
-              NO_AUTOUPDATE: "true"
+              NO_AUTOUPDATE: true
               TUNNEL_CRED_FILE: /etc/cloudflared/creds/credentials.json
               TUNNEL_METRICS: 0.0.0.0:8080
               TUNNEL_ORIGIN_ENABLE_HTTP2: true
@@ -67,21 +67,30 @@ spec:
               readiness: *probes
               startup:
                 enabled: false
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+              seccompProfile:
+                type: RuntimeDefault
             resources:
               requests:
-                cpu: 5m
-                memory: 128M
+                cpu: 10m
               limits:
-                memory: 256M
+                memory: 256Mi
         pod:
           securityContext:
-            runAsUser: 568
-            runAsGroup: 568
+            runAsUser: 65534
+            runAsGroup: 65534
+            runAsNonRoot: true
     service:
       main:
         ports:
           http:
             port: *port
+    serviceMonitor:
+      main:
+        enabled: true
     persistence:
       config:
         enabled: true