Overriding Security Contexts

Override the default pod, container, and init container security contexts for Connectware and Connectware agent components, including OpenShift-specific configuration.

Advanced configuration, use with caution

Test every security context change before deploying to production. Not all combinations of permissions and container configuration are supported.

Default Security Contexts

By default, the connectware and connectware-agent Helm charts apply the following security contexts to follow best practice by running with low privileges:

Pod security context

runAsNonRoot: true
seccompProfile:
  type: RuntimeDefault
fsGroup: 1000

Container and init container security context

allowPrivilegeEscalation: false
capabilities:
  drop:
    - ALL

These defaults follow Kubernetes security best practices, running all containers as a non-root user with a minimal set of capabilities.

When to Override Security Contexts

You may need to customize these defaults when:

Custom compliance requirements: Your organization may require specific runAsUser, runAsGroup, or fsGroup values to meet security policy or regulatory requirements.
Restricted cluster policies: Some clusters enforce admission controllers or OPA policies that require specific security context values. For example, OpenShift manages UID/GID assignments through SecurityContextConstraints (SCC), and setting fsGroup can conflict with OpenShift's pod admission.

Configuration Values

The following Helm values can be used to customize security contexts. All overrides accept standard Kubernetes security context definitions.

Value

Description

global.podSecurityContextOverride

Overrides the pod security context.

global.containerSecurityContextOverride

Overrides the container security context.

global.initContainerSecurityContextOverride

Overrides the init container security context. If not set, falls back to containerSecurityContext.

${COMPONENT_NAME}.podSecurityContextOverride

Overrides the pod security context for a specific component.

${COMPONENT_NAME}.containerSecurityContextOverride

Overrides the container security context for a specific component.

${COMPONENT_NAME}.initContainerSecurityContextOverride

Overrides the init container security context for a specific component. If not set, falls back to containerSecurityContext.

Value

Description

protocolMapperAgentDefaults.podSecurityContextOverride

Overrides the pod security context for all agents.

protocolMapperAgentDefaults.containerSecurityContextOverride

Overrides the container security context for all agents.

protocolMapperAgentDefaults.initContainerSecurityContextOverride

Overrides the init container security context for all agents. If not set, falls back to containerSecurityContext.

protocolMapperAgents[].${AGENT_NAME}.podSecurityContextOverride

Overrides the pod security context for a specific agent.

protocolMapperAgents[].${AGENT_NAME}.containerSecurityContextOverride

Overrides the container security context for a specific agent.

protocolMapperAgents[].${AGENT_NAME}.initContainerSecurityContextOverride

Overrides the init container security context for a specific agent. If not set, falls back to containerSecurityContext.

Overrides fully replace defaults without key merging

Security context overrides fully replace the default security context, individual keys are not merged. If you supply a podSecurityContextOverride with only runAsUser: 2000, all other defaults (runAsNonRoot, fsGroup, seccompProfile) are absent from the rendered manifest. You must include every field you want to retain.

Configuring Security Contexts

The following tabs show how to configure security context overrides for the connectware Helm chart and the connectware-agent Helm chart.

Configuring a Global Security Context Override

To apply a custom security context to all Connectware components at once, set the override values under global.

Example: Setting a custom pod security context globally

values.yaml

global:
  podSecurityContextOverride:
    runAsNonRoot: true
    runAsUser: 2000
    fsGroup: 2000
    seccompProfile:
      type: RuntimeDefault

Example: Setting a custom container security context globally

values.yaml

global:
  containerSecurityContextOverride:
    allowPrivilegeEscalation: false
    capabilities:
      drop:
        - ALL
    runAsUser: 2000

Example: Setting a separate init container security context globally

If not set, initContainerSecurityContextOverride falls back to containerSecurityContextOverride.

values.yaml

global:
  containerSecurityContextOverride:
    allowPrivilegeEscalation: false
    capabilities:
      drop:
        - ALL
  initContainerSecurityContextOverride:
    allowPrivilegeEscalation: false
    capabilities:
      drop:
        - ALL
    runAsUser: 1001

Configuring a Per-Component Security Context Override

You can override the security contexts for individual components by setting the same values under their own configuration section. A component-level value takes precedence over the global value.

All Connectware components support this value.

Example: Overriding the pod security context for the auth-server only

values.yaml

global:
# Note: 'authServer' is used as an example, but this configuration
# is applicable to any Connectware component.
authServer:
  podSecurityContextOverride:
    runAsNonRoot: true
    runAsUser: 1001
    runAsGroup: 1001
    fsGroup: 1001
    seccompProfile:
      type: RuntimeDefault

Only the authServer pod security context is overridden here. All other components retain their default security contexts, including other containers within the authServer pod.

Setting a Global Override with a Per-Component Exception

To apply a global security context while overriding a specific component, combine global values with a component-specific podSecurityContextOverride.

Example: Global override with a per-component exception for the broker

values.yaml

global:
  podSecurityContextOverride:
    runAsNonRoot: true
    runAsUser: 1001
    fsGroup: 1001
    seccompProfile:
      type: RuntimeDefault
  containerSecurityContextOverride:
    allowPrivilegeEscalation: false
    capabilities:
      drop:
        - ALL
    runAsUser: 1001
broker:
  podSecurityContextOverride:
    runAsNonRoot: true
    runAsUser: 1002
    fsGroup: 1002
    seccompProfile:
      type: RuntimeDefault

The broker component uses its own podSecurityContextOverride, which takes precedence over the global value. All other components use the global security context override.

The connectware-agent Helm chart can be deployed standalone or as a subchart within the connectware Helm chart. Both deployment modes use the same values structure, but when deployed as a subchart, configure it under the connectwareAgent section.

Configuring a Default Security Context for All Agents (Standalone Deployment)

To apply a custom security context to all agent pods at once, set the override values under protocolMapperAgentDefaults.

values.yaml

protocolMapperAgentDefaults:
  podSecurityContextOverride:
    runAsNonRoot: true
    runAsUser: 1001
    fsGroup: 1001
    seccompProfile:
      type: RuntimeDefault
  containerSecurityContextOverride:
    allowPrivilegeEscalation: false
    capabilities:
      drop:
        - ALL
protocolMapperAgents:
  - name: my-agent-1
  - name: my-agent-2

Configuring a Security Context for a Specific Agent (Standalone Deployment)

Individual agents can override the default setting by setting the same values under their own entry in protocolMapperAgents[]. An agent-level value completely replaces the default configuration.

Example: Overriding the pod security context for a specific agent

values.yaml

protocolMapperAgentDefaults:
  podSecurityContextOverride:
    runAsNonRoot: true
    runAsUser: 1001
    fsGroup: 1001
    seccompProfile:
      type: RuntimeDefault
  containerSecurityContextOverride:
    allowPrivilegeEscalation: false
    capabilities:
      drop:
        - ALL

protocolMapperAgents:
  - name: my-standard-agent
  - name: my-special-agent
    podSecurityContextOverride:
      runAsNonRoot: true
      runAsUser: 1002
      fsGroup: 1002
      seccompProfile:
        type: RuntimeDefault

Deploying Agents as Part of the connectware Helm Chart with a Global Override

When deploying agents as part of the connectware Helm chart, setting a global security context override applies to all components, including agents.

values.yaml

global:
  podSecurityContextOverride:
    runAsNonRoot: true
    runAsUser: 2000
    runAsGroup: 2000
    fsGroup: 2000
    seccompProfile:
      type: RuntimeDefault
  containerSecurityContextOverride:
    allowPrivilegeEscalation: false
    capabilities:
      drop:
        - ALL
connectwareAgent:
  # ... shared defaults

  protocolMapperAgents:
    - name: my-agent

Deploying Agents as Part of the connectware Helm Chart with a Per-Agent Override

When deploying agents as part of the connectware Helm chart, you can combine a global security context override with a per-agent exception. Set the global values under global, then override a specific agent within the connectwareAgent section.

values.yaml

global:
  podSecurityContextOverride:
    runAsNonRoot: true
    runAsUser: 2000
    runAsGroup: 2000
    fsGroup: 2000
    seccompProfile:
      type: RuntimeDefault
  containerSecurityContextOverride:
    allowPrivilegeEscalation: false
    capabilities:
      drop:
        - ALL
connectwareAgent:
  # ... shared defaults

  protocolMapperAgents:
    - name: my-standard-agent
    - name: my-special-agent
      podSecurityContextOverride:
        runAsNonRoot: true
        runAsUser: 1003
        fsGroup: 1003
        seccompProfile:
          type: RuntimeDefault

Only my-special-agent uses its own podSecurityContextOverride. my-standard-agent inherits the global security context.

Unsetting fsGroup for OpenShift

On OpenShift, setting fsGroup in the pod security context can conflict with OpenShift's SecurityContextConstraints (SCC) admission. The recommended approach is to set fsGroup to null, which allows OpenShift to manage the security context according to the applied SCC.

Override the default pod security context in the connectware Helm chart to allow OpenShift to manage the fsGroup assignment:

values.yaml

global:
  podSecurityContextOverride:
    runAsNonRoot: true
    fsGroup: null
    seccompProfile:
      type: RuntimeDefault

Override the default pod security context in the connectware-agent Helm chart to allow OpenShift to manage the fsGroup assignment:

values.yaml

protocolMapperAgentDefaults:
  podSecurityContextOverride:
    runAsNonRoot: true
    fsGroup: null
    seccompProfile:
      type: RuntimeDefault

protocolMapperAgents:
  - name: my-agent

Reference

For the full list of security-context-related Helm values, see the Helm Chart Reference.

PreviousConfiguring Registries and Pull Secrets

NextPod Priority Classes

Last updated 1 month ago

Was this helpful?