Skip to main content

Pod security context

Last updated on

The pod and container security contexts control the user and group the operator containers run as. The installer sets runAsUser: 1000 and fsGroup: 1000 by default, and you can override these values to meet your organization's security policies.

Default security context​

The installer applies the following configuration unless you override it. The containers run as non-root, privilege escalation is disabled, and the RuntimeDefault seccomp profile is applied.

podSecurityContext:
  runAsUser: 1000
  fsGroup: 1000
  runAsNonRoot: true
  fsGroupChangePolicy: "OnRootMismatch"
  seccompProfile:
    type: RuntimeDefault

containerSecurityContext:
  runAsUser: 1000
  runAsGroup: 1000
  allowPrivilegeEscalation: false
  runAsNonRoot: true

Customize the security context​

Override the default user and group IDs when your security policies require different values. Select the tab that matches your installation method.

Override the default user and group IDs in override.yaml:

podSecurityContext:
  runAsUser: 65532
  fsGroup: 65532
  runAsNonRoot: true
  fsGroupChangePolicy: "OnRootMismatch"
  seccompProfile:
    type: RuntimeDefault

containerSecurityContext:
  runAsUser: 65532
  runAsGroup: 65532
  allowPrivilegeEscalation: false
  runAsNonRoot: true

Apply security context​

The security context is applied to multiple components, not to the installer pod alone. The following table lists each component and the context it receives.

ComponentContext applied
Installer podpodSecurityContext and containerSecurityContext
harness-nginxController pod and admission webhook patch job
nfs-provisionerProvisioner pod
  • Resource sizing: Default CPU and memory allocations for the operator and satellite.
  • CLI reference: Installation parameters for the helm and clustermgr flows.
  • Installation: Deploy the operator with Helm or clustermgr.