Skip to content

Latest commit

 

History

History
28 lines (21 loc) · 1.29 KB

workflow-pod-security-context.md

File metadata and controls

28 lines (21 loc) · 1.29 KB
Raw

Workflow Pod Security Context

By default, all workflow pods run as root.

You can run your workflow pods more securely by configuring the security context for your workflow pod.

This is likely to be necessary if pod security standards (PSS) are enforced by PSA or other means, or if you have a pod security policy (deprecated).

apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
  generateName: security-context-
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 8737 #; any non-root user

You can configure this globally using workflow defaults.

!!! Warning "It is easy to make a workflow need root unintentionally" You may find that user's workflows have been written to require root with seemingly innocuous code. E.g. mkdir /my-dir would require root.

!!! Note "You must use volumes for output artifacts" If you use runAsNonRoot - you cannot have output artifacts on base layer (e.g. /tmp). You must use a volume (e.g. empty dir).