Ревью: манифест Deployment

apiVersion: apps/v1
kind: Deployment
metadata: { name: api }
spec:
  template:
    spec:
      serviceAccountName: default
      hostNetwork: true
      containers:
        - name: api
          image: registry.example.com/api:latest
          securityContext:
            privileged: true
            runAsUser: 0
          env:
            - name: JWT_SECRET
              value: "change-me"
          volumeMounts:
            - { name: host, mountPath: /host }
      volumes:
        - name: host
          hostPath: { path: / }