We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Outpost cannot be created in restricted namespaces
**Describe the bug**
Creating outposts in restricted namespaces does not work due to securityContext settings not getting copied over from main deployment.

**To Reproduce**
Steps to reproduce the behavior:
1. Create a restricted namespace:
* kubectl create ns test-authentik
* kubectl label ns test-authentikpod-security.kubernetes.io/enforce=baseline --overwrite
2. Create a new Outpost, in configuration do:
kubernetes_namespace=test-authentik

**Expected behavior**
Outpost should be created successfully.

**Logs**
```bash
kubectl describe -n authentik replicasets.apps ak-outpost-default-ldap-outpost 
 ...
  Warning  FailedCreate  6m51s                replicaset-controller  Error creating: pods "ak-outpost-default-ldap-outpost-7f4d464f8c-7g76k" is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "ldap" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "ldap" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "ldap" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "ldap" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
 ```

**Version and Deployment (please complete the following information):**
 - authentik version: 23.3.1
 - Deployment: helm

**Workaround**
Edit deployment to use the same securityContext settings from main pod and container in new deployments.


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `authentik/outposts/controllers/k8s/deployment.py`
Content:
```
1 """Kubernetes Deployment Reconciler"""
2 from typing import TYPE_CHECKING
3 
4 from django.utils.text import slugify
5 from kubernetes.client import (
6     AppsV1Api,
7     V1Container,
8     V1ContainerPort,
9     V1Deployment,
10     V1DeploymentSpec,
11     V1EnvVar,
12     V1EnvVarSource,
13     V1LabelSelector,
14     V1ObjectMeta,
15     V1ObjectReference,
16     V1PodSpec,
17     V1PodTemplateSpec,
18     V1SecretKeySelector,
19 )
20 
21 from authentik import __version__, get_full_version
22 from authentik.outposts.controllers.base import FIELD_MANAGER
23 from authentik.outposts.controllers.k8s.base import KubernetesObjectReconciler
24 from authentik.outposts.controllers.k8s.triggers import NeedsUpdate
25 from authentik.outposts.controllers.k8s.utils import compare_ports
26 from authentik.outposts.models import Outpost
27 
28 if TYPE_CHECKING:
29     from authentik.outposts.controllers.kubernetes import KubernetesController
30 
31 
32 class DeploymentReconciler(KubernetesObjectReconciler[V1Deployment]):
33     """Kubernetes Deployment Reconciler"""
34 
35     outpost: Outpost
36 
37     def __init__(self, controller: "KubernetesController") -> None:
38         super().__init__(controller)
39         self.api = AppsV1Api(controller.client)
40         self.outpost = self.controller.outpost
41 
42     def reconcile(self, current: V1Deployment, reference: V1Deployment):
43         compare_ports(
44             current.spec.template.spec.containers[0].ports,
45             reference.spec.template.spec.containers[0].ports,
46         )
47         if current.spec.replicas != reference.spec.replicas:
48             raise NeedsUpdate()
49         if (
50             current.spec.template.spec.containers[0].image
51             != reference.spec.template.spec.containers[0].image
52         ):
53             raise NeedsUpdate()
54         super().reconcile(current, reference)
55 
56     def get_pod_meta(self, **kwargs) -> dict[str, str]:
57         """Get common object metadata"""
58         kwargs.update(
59             {
60                 "app.kubernetes.io/name": f"authentik-outpost-{self.outpost.type}",
61                 "app.kubernetes.io/managed-by": "goauthentik.io",
62                 "goauthentik.io/outpost-uuid": self.controller.outpost.uuid.hex,
63                 "goauthentik.io/outpost-name": slugify(self.controller.outpost.name),
64                 "goauthentik.io/outpost-type": str(self.controller.outpost.type),
65             }
66         )
67         return kwargs
68 
69     def get_reference_object(self) -> V1Deployment:
70         """Get deployment object for outpost"""
71         # Generate V1ContainerPort objects
72         container_ports = []
73         for port in self.controller.deployment_ports:
74             container_ports.append(
75                 V1ContainerPort(
76                     container_port=port.inner_port or port.port,
77                     name=port.name,
78                     protocol=port.protocol.upper(),
79                 )
80             )
81         meta = self.get_object_meta(name=self.name)
82         image_name = self.controller.get_container_image()
83         image_pull_secrets = self.outpost.config.kubernetes_image_pull_secrets
84         version = get_full_version()
85         return V1Deployment(
86             metadata=meta,
87             spec=V1DeploymentSpec(
88                 replicas=self.outpost.config.kubernetes_replicas,
89                 selector=V1LabelSelector(match_labels=self.get_pod_meta()),
90                 template=V1PodTemplateSpec(
91                     metadata=V1ObjectMeta(
92                         labels=self.get_pod_meta(
93                             **{
94                                 # Support istio-specific labels, but also use the standard k8s
95                                 # recommendations
96                                 "app.kubernetes.io/version": version,
97                                 "app": "authentik-outpost",
98                                 "version": version,
99                             }
100                         )
101                     ),
102                     spec=V1PodSpec(
103                         image_pull_secrets=[
104                             V1ObjectReference(name=secret) for secret in image_pull_secrets
105                         ],
106                         containers=[
107                             V1Container(
108                                 name=str(self.outpost.type),
109                                 image=image_name,
110                                 ports=container_ports,
111                                 env=[
112                                     V1EnvVar(
113                                         name="AUTHENTIK_HOST",
114                                         value_from=V1EnvVarSource(
115                                             secret_key_ref=V1SecretKeySelector(
116                                                 name=self.name,
117                                                 key="authentik_host",
118                                             )
119                                         ),
120                                     ),
121                                     V1EnvVar(
122                                         name="AUTHENTIK_HOST_BROWSER",
123                                         value_from=V1EnvVarSource(
124                                             secret_key_ref=V1SecretKeySelector(
125                                                 name=self.name,
126                                                 key="authentik_host_browser",
127                                             )
128                                         ),
129                                     ),
130                                     V1EnvVar(
131                                         name="AUTHENTIK_TOKEN",
132                                         value_from=V1EnvVarSource(
133                                             secret_key_ref=V1SecretKeySelector(
134                                                 name=self.name,
135                                                 key="token",
136                                             )
137                                         ),
138                                     ),
139                                     V1EnvVar(
140                                         name="AUTHENTIK_INSECURE",
141                                         value_from=V1EnvVarSource(
142                                             secret_key_ref=V1SecretKeySelector(
143                                                 name=self.name,
144                                                 key="authentik_host_insecure",
145                                             )
146                                         ),
147                                     ),
148                                 ],
149                             )
150                         ],
151                     ),
152                 ),
153             ),
154         )
155 
156     def create(self, reference: V1Deployment):
157         return self.api.create_namespaced_deployment(
158             self.namespace, reference, field_manager=FIELD_MANAGER
159         )
160 
161     def delete(self, reference: V1Deployment):
162         return self.api.delete_namespaced_deployment(reference.metadata.name, self.namespace)
163 
164     def retrieve(self) -> V1Deployment:
165         return self.api.read_namespaced_deployment(self.name, self.namespace)
166 
167     def update(self, current: V1Deployment, reference: V1Deployment):
168         return self.api.patch_namespaced_deployment(
169             current.metadata.name,
170             self.namespace,
171             reference,
172             field_manager=FIELD_MANAGER,
173         )
174
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/authentik/outposts/controllers/k8s/deployment.py b/authentik/outposts/controllers/k8s/deployment.py
--- a/authentik/outposts/controllers/k8s/deployment.py
+++ b/authentik/outposts/controllers/k8s/deployment.py
@@ -4,6 +4,7 @@
 from django.utils.text import slugify
 from kubernetes.client import (
     AppsV1Api,
+    V1Capabilities,
     V1Container,
     V1ContainerPort,
     V1Deployment,
@@ -13,9 +14,12 @@
     V1LabelSelector,
     V1ObjectMeta,
     V1ObjectReference,
+    V1PodSecurityContext,
     V1PodSpec,
     V1PodTemplateSpec,
+    V1SeccompProfile,
     V1SecretKeySelector,
+    V1SecurityContext,
 )
 
 from authentik import __version__, get_full_version
@@ -103,6 +107,12 @@
                         image_pull_secrets=[
                             V1ObjectReference(name=secret) for secret in image_pull_secrets
                         ],
+                        security_context=V1PodSecurityContext(
+                            run_as_non_root=True,
+                            seccomp_profile=V1SeccompProfile(
+                                type="RuntimeDefault",
+                            ),
+                        ),
                         containers=[
                             V1Container(
                                 name=str(self.outpost.type),
@@ -146,6 +156,12 @@
                                         ),
                                     ),
                                 ],
+                                security_context=V1SecurityContext(
+                                    allow_privilege_escalation=False,
+                                    capabilities=V1Capabilities(
+                                        drop=["ALL"],
+                                    ),
+                                ),
                             )
                         ],
                     ),

{"golden_diff": "diff --git a/authentik/outposts/controllers/k8s/deployment.py b/authentik/outposts/controllers/k8s/deployment.py\n--- a/authentik/outposts/controllers/k8s/deployment.py\n+++ b/authentik/outposts/controllers/k8s/deployment.py\n@@ -4,6 +4,7 @@\n from django.utils.text import slugify\n from kubernetes.client import (\n     AppsV1Api,\n+    V1Capabilities,\n     V1Container,\n     V1ContainerPort,\n     V1Deployment,\n@@ -13,9 +14,12 @@\n     V1LabelSelector,\n     V1ObjectMeta,\n     V1ObjectReference,\n+    V1PodSecurityContext,\n     V1PodSpec,\n     V1PodTemplateSpec,\n+    V1SeccompProfile,\n     V1SecretKeySelector,\n+    V1SecurityContext,\n )\n \n from authentik import __version__, get_full_version\n@@ -103,6 +107,12 @@\n                         image_pull_secrets=[\n                             V1ObjectReference(name=secret) for secret in image_pull_secrets\n                         ],\n+                        security_context=V1PodSecurityContext(\n+                            run_as_non_root=True,\n+                            seccomp_profile=V1SeccompProfile(\n+                                type=\"RuntimeDefault\",\n+                            ),\n+                        ),\n                         containers=[\n                             V1Container(\n                                 name=str(self.outpost.type),\n@@ -146,6 +156,12 @@\n                                         ),\n                                     ),\n                                 ],\n+                                security_context=V1SecurityContext(\n+                                    allow_privilege_escalation=False,\n+                                    capabilities=V1Capabilities(\n+                                        drop=[\"ALL\"],\n+                                    ),\n+                                ),\n                             )\n                         ],\n                     ),\n", "issue": "Outpost cannot be created in restricted namespaces\n**Describe the bug**\r\nCreating outposts in restricted namespaces does not work due to securityContext settings not getting copied over from main deployment.\r\n\r\n**To Reproduce**\r\nSteps to reproduce the behavior:\r\n1. Create a restricted namespace:\r\n* kubectl create ns test-authentik\r\n* kubectl label ns test-authentikpod-security.kubernetes.io/enforce=baseline --overwrite\r\n2. Create a new Outpost, in configuration do:\r\nkubernetes_namespace=test-authentik\r\n\r\n**Expected behavior**\r\nOutpost should be created successfully.\r\n\r\n**Logs**\r\n```bash\r\nkubectl describe -n authentik replicasets.apps ak-outpost-default-ldap-outpost \r\n ...\r\n  Warning  FailedCreate  6m51s                replicaset-controller  Error creating: pods \"ak-outpost-default-ldap-outpost-7f4d464f8c-7g76k\" is forbidden: violates PodSecurity \"restricted:latest\": allowPrivilegeEscalation != false (container \"ldap\" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container \"ldap\" must set securityContext.capabilities.drop=[\"ALL\"]), runAsNonRoot != true (pod or container \"ldap\" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container \"ldap\" must set securityContext.seccompProfile.type to \"RuntimeDefault\" or \"Localhost\")\r\n ```\r\n\r\n**Version and Deployment (please complete the following information):**\r\n - authentik version: 23.3.1\r\n - Deployment: helm\r\n\r\n**Workaround**\r\nEdit deployment to use the same securityContext settings from main pod and container in new deployments.\r\n\n", "before_files": [{"content": "\"\"\"Kubernetes Deployment Reconciler\"\"\"\nfrom typing import TYPE_CHECKING\n\nfrom django.utils.text import slugify\nfrom kubernetes.client import (\n    AppsV1Api,\n    V1Container,\n    V1ContainerPort,\n    V1Deployment,\n    V1DeploymentSpec,\n    V1EnvVar,\n    V1EnvVarSource,\n    V1LabelSelector,\n    V1ObjectMeta,\n    V1ObjectReference,\n    V1PodSpec,\n    V1PodTemplateSpec,\n    V1SecretKeySelector,\n)\n\nfrom authentik import __version__, get_full_version\nfrom authentik.outposts.controllers.base import FIELD_MANAGER\nfrom authentik.outposts.controllers.k8s.base import KubernetesObjectReconciler\nfrom authentik.outposts.controllers.k8s.triggers import NeedsUpdate\nfrom authentik.outposts.controllers.k8s.utils import compare_ports\nfrom authentik.outposts.models import Outpost\n\nif TYPE_CHECKING:\n    from authentik.outposts.controllers.kubernetes import KubernetesController\n\n\nclass DeploymentReconciler(KubernetesObjectReconciler[V1Deployment]):\n    \"\"\"Kubernetes Deployment Reconciler\"\"\"\n\n    outpost: Outpost\n\n    def __init__(self, controller: \"KubernetesController\") -> None:\n        super().__init__(controller)\n        self.api = AppsV1Api(controller.client)\n        self.outpost = self.controller.outpost\n\n    def reconcile(self, current: V1Deployment, reference: V1Deployment):\n        compare_ports(\n            current.spec.template.spec.containers[0].ports,\n            reference.spec.template.spec.containers[0].ports,\n        )\n        if current.spec.replicas != reference.spec.replicas:\n            raise NeedsUpdate()\n        if (\n            current.spec.template.spec.containers[0].image\n            != reference.spec.template.spec.containers[0].image\n        ):\n            raise NeedsUpdate()\n        super().reconcile(current, reference)\n\n    def get_pod_meta(self, **kwargs) -> dict[str, str]:\n        \"\"\"Get common object metadata\"\"\"\n        kwargs.update(\n            {\n                \"app.kubernetes.io/name\": f\"authentik-outpost-{self.outpost.type}\",\n                \"app.kubernetes.io/managed-by\": \"goauthentik.io\",\n                \"goauthentik.io/outpost-uuid\": self.controller.outpost.uuid.hex,\n                \"goauthentik.io/outpost-name\": slugify(self.controller.outpost.name),\n                \"goauthentik.io/outpost-type\": str(self.controller.outpost.type),\n            }\n        )\n        return kwargs\n\n    def get_reference_object(self) -> V1Deployment:\n        \"\"\"Get deployment object for outpost\"\"\"\n        # Generate V1ContainerPort objects\n        container_ports = []\n        for port in self.controller.deployment_ports:\n            container_ports.append(\n                V1ContainerPort(\n                    container_port=port.inner_port or port.port,\n                    name=port.name,\n                    protocol=port.protocol.upper(),\n                )\n            )\n        meta = self.get_object_meta(name=self.name)\n        image_name = self.controller.get_container_image()\n        image_pull_secrets = self.outpost.config.kubernetes_image_pull_secrets\n        version = get_full_version()\n        return V1Deployment(\n            metadata=meta,\n            spec=V1DeploymentSpec(\n                replicas=self.outpost.config.kubernetes_replicas,\n                selector=V1LabelSelector(match_labels=self.get_pod_meta()),\n                template=V1PodTemplateSpec(\n                    metadata=V1ObjectMeta(\n                        labels=self.get_pod_meta(\n                            **{\n                                # Support istio-specific labels, but also use the standard k8s\n                                # recommendations\n                                \"app.kubernetes.io/version\": version,\n                                \"app\": \"authentik-outpost\",\n                                \"version\": version,\n                            }\n                        )\n                    ),\n                    spec=V1PodSpec(\n                        image_pull_secrets=[\n                            V1ObjectReference(name=secret) for secret in image_pull_secrets\n                        ],\n                        containers=[\n                            V1Container(\n                                name=str(self.outpost.type),\n                                image=image_name,\n                                ports=container_ports,\n                                env=[\n                                    V1EnvVar(\n                                        name=\"AUTHENTIK_HOST\",\n                                        value_from=V1EnvVarSource(\n                                            secret_key_ref=V1SecretKeySelector(\n                                                name=self.name,\n                                                key=\"authentik_host\",\n                                            )\n                                        ),\n                                    ),\n                                    V1EnvVar(\n                                        name=\"AUTHENTIK_HOST_BROWSER\",\n                                        value_from=V1EnvVarSource(\n                                            secret_key_ref=V1SecretKeySelector(\n                                                name=self.name,\n                                                key=\"authentik_host_browser\",\n                                            )\n                                        ),\n                                    ),\n                                    V1EnvVar(\n                                        name=\"AUTHENTIK_TOKEN\",\n                                        value_from=V1EnvVarSource(\n                                            secret_key_ref=V1SecretKeySelector(\n                                                name=self.name,\n                                                key=\"token\",\n                                            )\n                                        ),\n                                    ),\n                                    V1EnvVar(\n                                        name=\"AUTHENTIK_INSECURE\",\n                                        value_from=V1EnvVarSource(\n                                            secret_key_ref=V1SecretKeySelector(\n                                                name=self.name,\n                                                key=\"authentik_host_insecure\",\n                                            )\n                                        ),\n                                    ),\n                                ],\n                            )\n                        ],\n                    ),\n                ),\n            ),\n        )\n\n    def create(self, reference: V1Deployment):\n        return self.api.create_namespaced_deployment(\n            self.namespace, reference, field_manager=FIELD_MANAGER\n        )\n\n    def delete(self, reference: V1Deployment):\n        return self.api.delete_namespaced_deployment(reference.metadata.name, self.namespace)\n\n    def retrieve(self) -> V1Deployment:\n        return self.api.read_namespaced_deployment(self.name, self.namespace)\n\n    def update(self, current: V1Deployment, reference: V1Deployment):\n        return self.api.patch_namespaced_deployment(\n            current.metadata.name,\n            self.namespace,\n            reference,\n            field_manager=FIELD_MANAGER,\n        )\n", "path": "authentik/outposts/controllers/k8s/deployment.py"}], "after_files": [{"content": "\"\"\"Kubernetes Deployment Reconciler\"\"\"\nfrom typing import TYPE_CHECKING\n\nfrom django.utils.text import slugify\nfrom kubernetes.client import (\n    AppsV1Api,\n    V1Capabilities,\n    V1Container,\n    V1ContainerPort,\n    V1Deployment,\n    V1DeploymentSpec,\n    V1EnvVar,\n    V1EnvVarSource,\n    V1LabelSelector,\n    V1ObjectMeta,\n    V1ObjectReference,\n    V1PodSecurityContext,\n    V1PodSpec,\n    V1PodTemplateSpec,\n    V1SeccompProfile,\n    V1SecretKeySelector,\n    V1SecurityContext,\n)\n\nfrom authentik import __version__, get_full_version\nfrom authentik.outposts.controllers.base import FIELD_MANAGER\nfrom authentik.outposts.controllers.k8s.base import KubernetesObjectReconciler\nfrom authentik.outposts.controllers.k8s.triggers import NeedsUpdate\nfrom authentik.outposts.controllers.k8s.utils import compare_ports\nfrom authentik.outposts.models import Outpost\n\nif TYPE_CHECKING:\n    from authentik.outposts.controllers.kubernetes import KubernetesController\n\n\nclass DeploymentReconciler(KubernetesObjectReconciler[V1Deployment]):\n    \"\"\"Kubernetes Deployment Reconciler\"\"\"\n\n    outpost: Outpost\n\n    def __init__(self, controller: \"KubernetesController\") -> None:\n        super().__init__(controller)\n        self.api = AppsV1Api(controller.client)\n        self.outpost = self.controller.outpost\n\n    def reconcile(self, current: V1Deployment, reference: V1Deployment):\n        compare_ports(\n            current.spec.template.spec.containers[0].ports,\n            reference.spec.template.spec.containers[0].ports,\n        )\n        if current.spec.replicas != reference.spec.replicas:\n            raise NeedsUpdate()\n        if (\n            current.spec.template.spec.containers[0].image\n            != reference.spec.template.spec.containers[0].image\n        ):\n            raise NeedsUpdate()\n        super().reconcile(current, reference)\n\n    def get_pod_meta(self, **kwargs) -> dict[str, str]:\n        \"\"\"Get common object metadata\"\"\"\n        kwargs.update(\n            {\n                \"app.kubernetes.io/name\": f\"authentik-outpost-{self.outpost.type}\",\n                \"app.kubernetes.io/managed-by\": \"goauthentik.io\",\n                \"goauthentik.io/outpost-uuid\": self.controller.outpost.uuid.hex,\n                \"goauthentik.io/outpost-name\": slugify(self.controller.outpost.name),\n                \"goauthentik.io/outpost-type\": str(self.controller.outpost.type),\n            }\n        )\n        return kwargs\n\n    def get_reference_object(self) -> V1Deployment:\n        \"\"\"Get deployment object for outpost\"\"\"\n        # Generate V1ContainerPort objects\n        container_ports = []\n        for port in self.controller.deployment_ports:\n            container_ports.append(\n                V1ContainerPort(\n                    container_port=port.inner_port or port.port,\n                    name=port.name,\n                    protocol=port.protocol.upper(),\n                )\n            )\n        meta = self.get_object_meta(name=self.name)\n        image_name = self.controller.get_container_image()\n        image_pull_secrets = self.outpost.config.kubernetes_image_pull_secrets\n        version = get_full_version()\n        return V1Deployment(\n            metadata=meta,\n            spec=V1DeploymentSpec(\n                replicas=self.outpost.config.kubernetes_replicas,\n                selector=V1LabelSelector(match_labels=self.get_pod_meta()),\n                template=V1PodTemplateSpec(\n                    metadata=V1ObjectMeta(\n                        labels=self.get_pod_meta(\n                            **{\n                                # Support istio-specific labels, but also use the standard k8s\n                                # recommendations\n                                \"app.kubernetes.io/version\": version,\n                                \"app\": \"authentik-outpost\",\n                                \"version\": version,\n                            }\n                        )\n                    ),\n                    spec=V1PodSpec(\n                        image_pull_secrets=[\n                            V1ObjectReference(name=secret) for secret in image_pull_secrets\n                        ],\n                        security_context=V1PodSecurityContext(\n                            run_as_non_root=True,\n                            seccomp_profile=V1SeccompProfile(\n                                type=\"RuntimeDefault\",\n                            ),\n                        ),\n                        containers=[\n                            V1Container(\n                                name=str(self.outpost.type),\n                                image=image_name,\n                                ports=container_ports,\n                                env=[\n                                    V1EnvVar(\n                                        name=\"AUTHENTIK_HOST\",\n                                        value_from=V1EnvVarSource(\n                                            secret_key_ref=V1SecretKeySelector(\n                                                name=self.name,\n                                                key=\"authentik_host\",\n                                            )\n                                        ),\n                                    ),\n                                    V1EnvVar(\n                                        name=\"AUTHENTIK_HOST_BROWSER\",\n                                        value_from=V1EnvVarSource(\n                                            secret_key_ref=V1SecretKeySelector(\n                                                name=self.name,\n                                                key=\"authentik_host_browser\",\n                                            )\n                                        ),\n                                    ),\n                                    V1EnvVar(\n                                        name=\"AUTHENTIK_TOKEN\",\n                                        value_from=V1EnvVarSource(\n                                            secret_key_ref=V1SecretKeySelector(\n                                                name=self.name,\n                                                key=\"token\",\n                                            )\n                                        ),\n                                    ),\n                                    V1EnvVar(\n                                        name=\"AUTHENTIK_INSECURE\",\n                                        value_from=V1EnvVarSource(\n                                            secret_key_ref=V1SecretKeySelector(\n                                                name=self.name,\n                                                key=\"authentik_host_insecure\",\n                                            )\n                                        ),\n                                    ),\n                                ],\n                                security_context=V1SecurityContext(\n                                    allow_privilege_escalation=False,\n                                    capabilities=V1Capabilities(\n                                        drop=[\"ALL\"],\n                                    ),\n                                ),\n                            )\n                        ],\n                    ),\n                ),\n            ),\n        )\n\n    def create(self, reference: V1Deployment):\n        return self.api.create_namespaced_deployment(\n            self.namespace, reference, field_manager=FIELD_MANAGER\n        )\n\n    def delete(self, reference: V1Deployment):\n        return self.api.delete_namespaced_deployment(reference.metadata.name, self.namespace)\n\n    def retrieve(self) -> V1Deployment:\n        return self.api.read_namespaced_deployment(self.name, self.namespace)\n\n    def update(self, current: V1Deployment, reference: V1Deployment):\n        return self.api.patch_namespaced_deployment(\n            current.metadata.name,\n            self.namespace,\n            reference,\n            field_manager=FIELD_MANAGER,\n        )\n", "path": "authentik/outposts/controllers/k8s/deployment.py"}]}