Overriding Security Contexts

Override the default pod, container, and init container security contexts for Connectware and Connectware agent components, including OpenShift-specific configuration.

Advanced configuration, use with caution

Test every security context change before deploying to production. Not all combinations of permissions and container configuration are supported.

Default Security Contexts

By default, the connectware and connectware-agent Helm charts apply the following security contexts to follow best practice by running with low privileges:

Pod security context

runAsNonRoot: true
seccompProfile:
  type: RuntimeDefault
fsGroup: 1000

Container and init container security context

allowPrivilegeEscalation: false
capabilities:
  drop:
    - ALL

These defaults follow Kubernetes security best practices, running all containers as a non-root user with a minimal set of capabilities.

When to Override Security Contexts

You may need to customize these defaults when:

• Custom compliance requirements: Your organization may require specific runAsUser, runAsGroup, or fsGroup values to meet security policy or regulatory requirements.

• Restricted cluster policies: Some clusters enforce admission controllers or OPA policies that require specific security context values. For example, OpenShift manages UID/GID assignments through SecurityContextConstraints (SCC), and setting fsGroup can conflict with OpenShift's pod admission.

Configuration Values

The following Helm values can be used to customize security contexts. All overrides accept standard Kubernetes security context definitions.

connectware Helm Chart Values

Value	Description
global.podSecurityContextOverride	Overrides the pod security context.
global.containerSecurityContextOverride	Overrides the container security context.
global.initContainerSecurityContextOverride	Overrides the init container security context. If not set, falls back to containerSecurityContext.
${COMPONENT_NAME}.podSecurityContextOverride	Overrides the pod security context for a specific component.
${COMPONENT_NAME}.containerSecurityContextOverride	Overrides the container security context for a specific component.
${COMPONENT_NAME}.initContainerSecurityContextOverride	Overrides the init container security context for a specific component. If not set, falls back to containerSecurityContext.

connectware-agent Helm Chart Values

Overrides fully replace defaults without key merging

Security context overrides fully replace the default security context, individual keys are not merged. If you supply a podSecurityContextOverride with only runAsUser: 2000, all other defaults (runAsNonRoot, fsGroup, seccompProfile) are absent from the rendered manifest. You must include every field you want to retain.

Configuring Security Contexts

The following tabs show how to configure security context overrides for the connectware Helm chart and the connectware-agent Helm chart.

connectware Helm Chart

Configuring a Global Security Context Override

To apply a custom security context to all Connectware components at once, set the override values under global.

Example: Setting a custom pod security context globally

values.yaml

global:
  podSecurityContextOverride:
    runAsNonRoot: true
    runAsUser: 2000
    fsGroup: 2000
    seccompProfile:
      type: RuntimeDefault

Example: Setting a custom container security context globally

values.yaml

global:
  containerSecurityContextOverride:
    allowPrivilegeEscalation: false
    capabilities:
      drop:
        - ALL
    runAsUser: 2000

Example: Setting a separate init container security context globally

If not set, initContainerSecurityContextOverride falls back to containerSecurityContextOverride.

values.yaml

global:
  containerSecurityContextOverride:
    allowPrivilegeEscalation: false
    capabilities:
      drop:
        - ALL
  initContainerSecurityContextOverride:
    allowPrivilegeEscalation: false
    capabilities:
      drop:
        - ALL
    runAsUser: 1001

Configuring a Per-Component Security Context Override

You can override the security contexts for individual components by setting the same values under their own configuration section. A component-level value takes precedence over the global value.

All Connectware components support this value.

Example: Overriding the pod security context for the auth-server only

values.yaml

global:
# Note: 'authServer' is used as an example, but this configuration
# is applicable to any Connectware component.
authServer:
  podSecurityContextOverride:
    runAsNonRoot: true
    runAsUser: 1001
    runAsGroup: 1001
    fsGroup: 1001
    seccompProfile:
      type: RuntimeDefault

Only the authServer pod security context is overridden here. All other components retain their default security contexts, including other containers within the authServer pod.

Setting a Global Override with a Per-Component Exception

To apply a global security context while overriding a specific component, combine global values with a component-specific podSecurityContextOverride.

Example: Global override with a per-component exception for the broker

values.yaml

global:
  podSecurityContextOverride:
    runAsNonRoot: true
    runAsUser: 1001
    fsGroup: 1001
    seccompProfile:
      type: RuntimeDefault
  containerSecurityContextOverride:
    allowPrivilegeEscalation: false
    capabilities:
      drop:
        - ALL
    runAsUser: 1001
broker:
  podSecurityContextOverride:
    runAsNonRoot: true
    runAsUser: 1002
    fsGroup: 1002
    seccompProfile:
      type: RuntimeDefault

The broker component uses its own podSecurityContextOverride, which takes precedence over the global value. All other components use the global security context override.

connectware-agent Helm Chart

Unsetting fsGroup for OpenShift

On OpenShift, setting fsGroup in the pod security context can conflict with OpenShift's SecurityContextConstraints (SCC) admission. The recommended approach is to set fsGroup to null, which allows OpenShift to manage the security context according to the applied SCC.

connectware Helm Chart

Override the default pod security context in the connectware Helm chart to allow OpenShift to manage the fsGroup assignment:

values.yaml

global:
  podSecurityContextOverride:
    runAsNonRoot: true
    fsGroup: null
    seccompProfile:
      type: RuntimeDefault

connectware-agent Helm Chart

Reference

For the full list of security-context-related Helm values, see the Helm Chart Reference.