> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/operator-installation/advanced-configuration/pod-security-context.md).

# Pod security context

The pod and container security contexts control the user and group the operator containers run as. The installer sets `runAsUser: 1000` and `fsGroup: 1000` by default, and you can override these values to meet your organization's security policies.

***

### Default security context <a href="#default-security-context" id="default-security-context"></a>

The installer applies the following configuration unless you override it. The containers run as non-root, privilege escalation is disabled, and the `RuntimeDefault` seccomp profile is applied.

```yaml
podSecurityContext:
  runAsUser: 1000
  fsGroup: 1000
  runAsNonRoot: true
  fsGroupChangePolicy: "OnRootMismatch"
  seccompProfile:
    type: RuntimeDefault

containerSecurityContext:
  runAsUser: 1000
  runAsGroup: 1000
  allowPrivilegeEscalation: false
  runAsNonRoot: true
```

***

### Customize the security context <a href="#customize-the-security-context" id="customize-the-security-context"></a>

Override the default user and group IDs when your security policies require different values. Select the tab that matches your installation method.

{% tabs %}
{% tab title="helm" %}
Override the default user and group IDs in `override.yaml`:

```yaml
podSecurityContext:
  runAsUser: 65532
  fsGroup: 65532
  runAsNonRoot: true
  fsGroupChangePolicy: "OnRootMismatch"
  seccompProfile:
    type: RuntimeDefault

containerSecurityContext:
  runAsUser: 65532
  runAsGroup: 65532
  allowPrivilegeEscalation: false
  runAsNonRoot: true
```

{% endtab %}

{% tab title="clustermgr" %}
Pass the user and group IDs as input arguments on the install command:

```bash
./clustermgr install-pi \
  --dns platform.example.com \
  --version 0.43.0 \
  -i runAsUser=65532 \
  -i fsGroup=65532
```

The command sets the following values:

```yaml
podSecurityContext:
  runAsUser: 65532
  fsGroup: 65532

containerSecurityContext:
  runAsUser: 65532
  runAsGroup: 65532
```

{% endtab %}
{% endtabs %}

***

### Apply security context <a href="#apply-security-context" id="apply-security-context"></a>

The security context is applied to multiple components, not to the installer pod alone. The following table lists each component and the context it receives.

| Component           | Context applied                                     |
| ------------------- | --------------------------------------------------- |
| **Installer pod**   | `podSecurityContext` and `containerSecurityContext` |
| **harness-nginx**   | Controller pod and admission webhook patch job      |
| **nfs-provisioner** | Provisioner pod                                     |

***

### Related articles <a href="#related-articles" id="related-articles"></a>

* [Resource sizing](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/operator-installation/advanced-configuration/resource-sizing.md): Default CPU and memory allocations for the operator and satellite.
* [CLI reference](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/operator-installation/cli-reference.md): Installation parameters for the helm and clustermgr flows.
* [Installation](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/operator-installation/install/index.md): Deploy the operator with Helm or clustermgr.