Pod security context
Configure pod and container security contexts for non-root container execution.
The pod and container security contexts control the user and group the operator containers run as. The installer sets runAsUser: 1000 and fsGroup: 1000 by default, and you can override these values to meet your organization's security policies.
Default security context
The installer applies the following configuration unless you override it. The containers run as non-root, privilege escalation is disabled, and the RuntimeDefault seccomp profile is applied.
podSecurityContext:
runAsUser: 1000
fsGroup: 1000
runAsNonRoot: true
fsGroupChangePolicy: "OnRootMismatch"
seccompProfile:
type: RuntimeDefault
containerSecurityContext:
runAsUser: 1000
runAsGroup: 1000
allowPrivilegeEscalation: false
runAsNonRoot: trueCustomize the security context
Override the default user and group IDs when your security policies require different values. Select the tab that matches your installation method.
Override the default user and group IDs in override.yaml:
Pass the user and group IDs as input arguments on the install command:
The command sets the following values:
Apply security context
The security context is applied to multiple components, not to the installer pod alone. The following table lists each component and the context it receives.
Installer pod
podSecurityContext and containerSecurityContext
harness-nginx
Controller pod and admission webhook patch job
nfs-provisioner
Provisioner pod
Related articles
Resource sizing: Default CPU and memory allocations for the operator and satellite.
CLI reference: Installation parameters for the helm and clustermgr flows.
Installation: Deploy the operator with Helm or clustermgr.
Last updated
Was this helpful?