Security Context

Appears in

.Values.securityContext

Defaults

securityContext:
  container:
    PUID: 568
    UMASK: "002"
    runAsNonRoot: true
    runAsUser: 568
    runAsGroup: 568
    readOnlyRootFilesystem: true
    allowPrivilegeEscalation: false
    privileged: false
    seccompProfile:
      type: RuntimeDefault
    capabilities:
      add: []
      drop:
        - ALL
  pod:
    fsGroup: 568
    fsGroupChangePolicy: OnRootMismatch
    supplementalGroups: []
    sysctls: []

`securityContext.container`

Defines the security context for the container. Can be overridden at container level.

See Container Security Context

Default

securityContext:
  container:
    PUID: 568
    UMASK: "002"
    runAsNonRoot: true
    runAsUser: 568
    runAsGroup: 568
    readOnlyRootFilesystem: true
    allowPrivilegeEscalation: false
    privileged: false
    seccompProfile:
      type: RuntimeDefault
    capabilities:
      add: []
      drop:
        - ALL

`securityContext.container.PUID`

See Container Fixed Env PUID

Default

securityContext:
  container:
    PUID: 568

`securityContext.container.UMASK`

See Container Fixed Env UMASK

Default

securityContext:
  container:
    UMASK: "002"

`securityContext.container.runAsNonRoot`

See Container Run As Non Root

Default

securityContext:
  container:
    runAsNonRoot: true

`securityContext.container.runAsUser`

See Container Run As User

Default

securityContext:
  container:
    runAsUser: 568

`securityContext.container.runAsGroup`

See Container Run As Group

Default

securityContext:
  container:
    runAsGroup: 568

`securityContext.container.readOnlyRootFilesystem`

See Container Read Only Root Filesystem

Default

securityContext:
  container:
    readOnlyRootFilesystem: true

`securityContext.container.allowPrivilegeEscalation`

See Container Allow Privilege Escalation

Default

securityContext:
  container:
    allowPrivilegeEscalation: false

`securityContext.container.privileged`

See Container Privileged

Default

securityContext:
  container:
    privileged: false

`securityContext.container.seccompProfile`

See Container Seccomp Profile

Default

securityContext:
  container:
    seccompProfile:
      type: RuntimeDefault

`securityContext.container.seccompProfile.type`

See Container Seccomp Profile Type

Default

securityContext:
  container:
    seccompProfile:
      type: RuntimeDefault

`securityContext.container.seccompProfile.profile`

See Container Seccomp Profile Profile

Default

securityContext:
  container:
    seccompProfile:
      profile: ""

`securityContext.container.capabilities`

See Container Capabilities

Default

securityContext:
  container:
    capabilities:
      add: []
      drop:
        - ALL

`securityContext.container.capabilities.add`

See Container Capabilities Add

Default

securityContext:
  container:
    capabilities:
      add: []

`securityContext.container.capabilities.drop`

See Container Capabilities Drop

Default

securityContext:
  container:
    capabilities:
      drop:
        - ALL

`securityContext.pod`

Defines the security context for the pod. Can be overridden at pod level.

See Pod Security Context

Default

securityContext:
  pod:
    fsGroup: 568
    fsGroupChangePolicy: OnRootMismatch
    supplementalGroups: []
    sysctls: []

`securityContext.pod.fsGroup`

See Pod FS Group

Default

securityContext:
  pod:
    fsGroup: 568

`securityContext.pod.fsGroupChangePolicy`

See Pod FS Group Change Policy

Default

securityContext:
  pod:
    fsGroupChangePolicy: OnRootMismatch

`securityContext.pod.supplementalGroups`

See Pod Supplemental Groups

Default

securityContext:
  pod:
    supplementalGroups: []

`securityContext.pod.sysctls`

See Pod Sysctls

Default

securityContext:
  pod:
    sysctls: []

Full Examples

securityContext:
  container:
    PUID: 568
    UMASK: "002"
    runAsNonRoot: true
    runAsUser: 568
    runAsGroup: 568
    readOnlyRootFilesystem: true
    allowPrivilegeEscalation: false
    privileged: false
    seccompProfile:
      type: RuntimeDefault
    capabilities:
      add:
        - SYS_ADMIN
        - SYS_PTRACE
      drop:
        - ALL
  pod:
    fsGroup: 568
    fsGroupChangePolicy: OnRootMismatch
    supplementalGroups:
      - 568
      - 1000
    sysctls:
      - name: net.ipv4.ip_unprivileged_port_start
        value: "0"