Kubernetes pod security

Domino leverages Kubernetes security contexts to deploy pods with the least privileges necessary for them to function.

By default, pods created by Domino run with the following settings:

Run as a non-root user with runAsRoot: false, runAsNonRoot: true, and privileged: false set.
Acquisition of additional system-level capabilities must be prevented with drop: ["ALL"].

Domino does not support a policy where readOnlyRootFilesystem is set.

In addition, due to inconsistency between SELinux support and volume relabeling, all Domino pods run with an SELinux type option spc_t. This setting purposefully bypasses volume relabeling due to the performance impact of volume relabeling while creating Domino user workloads.

Pods that do not adhere to the policies above, such as requiring root privileges or additional capabilities, are documented below with privileged indicating pods that need additional user or root privileges and capabilities indicated pods that may require additional system-level capabilities.

Pod Name Exceptions Description

Pod Name	Exceptions	Description
`aws-ebs-csi-driver-controller`	`capabilities`	Requires access to host node resources in order provision and manage AWS EBS volumes for Domino. Will not be installed if AWS EBS is not configured as a storage provider during installation.
`aws-ebs-csi-driver-node`	`privileged` `runAsRoot`	Requires access to host node resources in order to provision and manage AWS EBS volumes for Domino. Will not be installed if AWS EBS is not configured as a storage provider during installation.
`aws-efs-csi-driver-controller`	`privileged` `runAsRoot`	Requires access to host node resources in order manage AWS EFS volumes for Domino. Will not be installed if AWS EFS is not configured as a storage provider during installation.
`aws-efs-csi-driver-node`	`privileged` `runAsRoot`	Requires access to host node resources in order manage AWS EFS volumes for Domino. Will not be installed if AWS EFS is not configured as a storage provider during installation.
`cluster-autoscaler`	`capabilities`	Cluster Autoscaler without default capabilities is not currently supported, but does run as a non-root user by default. Primarily used for AWS node pool autoscaling and will not be installed if autoscaling is managed by the cloud provider (GCP, Azure).
`csi-driver-smb-controller`	`privileged` `runAsRoot`	Requires access to host node resources in order to manage SMB volumes for Domino. Will not be installed if SMB volume management is not configured during installation.
`csi-driver-smb-linux`	`privileged` `runAsRoot`	Requires access to host node resources in order to manage SMB volumes for Domino. Will not be installed if SMB volume management is not configured during installation.
`data-plane-agent`	`capabilities`	Data Plane Agent without default capabilities is not currently supported, but does run as a non-root user by default. Data Plane Agent powers Domino’s compute workload management for local and hybrid data planes.
`docker-registry-cert-mgr`	`capabilities` `runAsRoot`	Requires access to host node resources in order to manage trusted certificates for Docker when Domino is configured to use a self-provided image registry. Will not be installed if an external Docker registry is configured during installation.
`docker-registry`	`capabilities`	Docker Registry without default capabilities is not currently supported, but does run as a non-root user by default when Domino is configured to use a self-provided image registry. Will not be installed if an external Docker registry is configured during installation.
`domino-workbench-backup`	`capabilities` `runAsRoot`	Requires privileged access to filesystem resources for data backup.
`domino-data-importer`	`capabilities` `runAsRoot`	Requires privileged access to filesystem resources for disaster recovery and data access. This service does not run by default and must be enabled by admins when needed.
`elasticsearch-tls`	`privileged` `runAsRoot`	Requires privileged access to system in order to set a mandatory system limit. If the system setting can be managed outside of Domino, elevated privileges can be removed by setting the following: `elasticsearch: enable_sysctl: false`
`fluentd`	`capabilities` `runAsRoot`	Requires access to host node resources in order to follow container logs which are used to view workload output within Domino.
`hephaestus-buildkit`	`privileged` `runAsRoot`	BuildKit powers container image building for the environments feature of Domino. By default, requires privileged access in order to utilize `overlay` mounts for performance during container image building. If your operating system supports rootless overlayfs natively, the privileges can be removed by setting the following: `image_building: rootless: true`
`image-cache-agent`	`capabilities` `runAsRoot`	Requires access to host node resources in order to communicate with the container runtime when caching container images for faster workload scheduling. Can be disabled by setting the following: `image_caching: enabled: false`
`istio-cni-node`	`capabilities` `runAsRoot`	Requires access to host node resources in order to facilitate network setup for Istio. Will not be installed if Istio is not enabled or the CNI option is disabled.
`metrics-server`	`capabilities`	Metrics Server without default capabilities is not currently supported, but does run as a non-root user by default. Metrics Server exposes container runtime metrics (CPU and memory) that allows user workloads created in Domino to horizontally scale automatically.
`mlflow-postgresql-slave`	`capabilities`	PostgreSQL without default capabilities is not currently supported, but does run as a non-root user by default. Will not be installed if MFLow is not configured for Domino during installation.
`mlflow`	`capabilities`	MLFlow without default capabilities is not currently supported, but does run as a non-root user by default. Will not be installed if MFLow is not configured for Domino during installation.
`mongodb-primary`	`capabilities`	MongoDB without default capabilities is not currently supported, but does run as a non-root user by default.
`mongodb-secondary`	`capabilities`	MongoDB without default capabilities is not currently supported, but does run as a non-root user by default.
`newrelic-infrastructure`	`privileged` `runAsRoot`	Requires access to host node resources in order to effectively monitor CPU, memory, network, and disk usage and report to New Relic. Will not be installed if New Relic is not configured for Domino during installation.
`newrelic-infrastructure-monitor-services`	`capabilities`	New Relic Infrastructure monitoring without default capabilities is not currently supported, but does run as a non-root user by default. Will not be installed if New Relic is not configured for Domino during installation.
`newrelic-logging`	`capabilities` `runAsRoot`	Requires access to host node resources in order to follow container logs and report to New Relic. Will not be installed if New Relic is not configured for Domino during installation.
`nfs-client-provisioner`	`capabilities` `runAsRoot`	NFS Client Provisioner requires privileged access to filesystem resources in order to manage NFS volumes for Domino. Will not be installed if NFS is not configured as a storage provider during installation.
`nvidia-device-plugin`	`capabilities` `runAsRoot`	Requires access to host node resources in order to communicate with the Kubernetes device API and expose NVIDIA GPU resources to the cluster. Will not be installed if GPU capabilities are not configuring during installation.
`nvidia-driver-installer`	`privileged` `runAsRoot`	Requires access to host node resources in order to install and manage NVIDIA drivers for GPU-enabled instance types. Only required for installations on GKE clusters.
`openebs`	`capabilities` `runAsRoot`	Requires access to host node resources in order to manage storage volumes. Will not be installed if OpenEBS is not configured as a storage provider during installation.
`postgresql-slave`	`capabilities`	PostgreSQL without default capabilities is not currently supported, but does run as a non-root user by default.
`prometheus-node-exporter`	`capabilities`	Requires access to host node resources in order to effectively monitor CPU, memory, network, and disk usage and report to Prometheus.
`seldon-controller-manager`	`capabilities`	Seldon manages model API deployment and processing. Seldon without default capabilities is not currently supported, but does run as a non-root user by default.
`shoreline-agent`	`capabilities` `runAsRoot`	Requires access to host node resources in order to effectively monitor CPU, memory, network, and disk usage and report back to Shoreline. Will not be installed if Shoreline is not configured for Domino during installation.
`smarter-device-manager`	`runAsRoot`	Requires access to host node resources in order to communicate with the Kubernetes device API and expose FUSE devices to the cluster.
`starburst-coordinator`	`capabilities`	Starburst allows users to manage and query data sources efficiently. Starburst without default capabilities is not currently supported, but does run as a non-root user by default.
`starburst-worker`	`capabilities`	Starburst allows users to manage and query data sources efficiently. Starburst without default capabilities is not currently supported, but does run as a non-root user by default.

aws-ebs-csi-driver-controller

capabilities

Requires access to host node resources in order provision and manage AWS EBS volumes for Domino. Will not be installed if AWS EBS is not configured as a storage provider during installation.

aws-ebs-csi-driver-node

privileged
runAsRoot

Requires access to host node resources in order to provision and manage AWS EBS volumes for Domino. Will not be installed if AWS EBS is not configured as a storage provider during installation.

aws-efs-csi-driver-controller

privileged
runAsRoot

Requires access to host node resources in order manage AWS EFS volumes for Domino. Will not be installed if AWS EFS is not configured as a storage provider during installation.

aws-efs-csi-driver-node

privileged
runAsRoot

Requires access to host node resources in order manage AWS EFS volumes for Domino. Will not be installed if AWS EFS is not configured as a storage provider during installation.

cluster-autoscaler

capabilities

Cluster Autoscaler without default capabilities is not currently supported, but does run as a non-root user by default. Primarily used for AWS node pool autoscaling and will not be installed if autoscaling is managed by the cloud provider (GCP, Azure).

csi-driver-smb-controller

privileged
runAsRoot

Requires access to host node resources in order to manage SMB volumes for Domino. Will not be installed if SMB volume management is not configured during installation.

csi-driver-smb-linux

privileged
runAsRoot

Requires access to host node resources in order to manage SMB volumes for Domino. Will not be installed if SMB volume management is not configured during installation.

data-plane-agent

capabilities

Data Plane Agent without default capabilities is not currently supported, but does run as a non-root user by default. Data Plane Agent powers Domino’s compute workload management for local and hybrid data planes.

docker-registry-cert-mgr

capabilities
runAsRoot

Requires access to host node resources in order to manage trusted certificates for Docker when Domino is configured to use a self-provided image registry. Will not be installed if an external Docker registry is configured during installation.

docker-registry

capabilities

Docker Registry without default capabilities is not currently supported, but does run as a non-root user by default when Domino is configured to use a self-provided image registry. Will not be installed if an external Docker registry is configured during installation.

domino-workbench-backup

capabilities
runAsRoot

Requires privileged access to filesystem resources for data backup.

domino-data-importer

capabilities
runAsRoot

Requires privileged access to filesystem resources for disaster recovery and data access. This service does not run by default and must be enabled by admins when needed.

elasticsearch-tls

privileged
runAsRoot

Requires privileged access to system in order to set a mandatory system limit. If the system setting can be managed outside of Domino, elevated privileges can be removed by setting the following:

elasticsearch:
  enable_sysctl: false

fluentd

capabilities
runAsRoot

Requires access to host node resources in order to follow container logs which are used to view workload output within Domino.

hephaestus-buildkit

privileged
runAsRoot

BuildKit powers container image building for the environments feature of Domino. By default, requires privileged access in order to utilize overlay mounts for performance during container image building. If your operating system supports rootless overlayfs natively, the privileges can be removed by setting the following:

image_building:
  rootless: true

image-cache-agent

capabilities
runAsRoot

Requires access to host node resources in order to communicate with the container runtime when caching container images for faster workload scheduling. Can be disabled by setting the following:

image_caching:
  enabled: false

istio-cni-node

capabilities
runAsRoot

Requires access to host node resources in order to facilitate network setup for Istio. Will not be installed if Istio is not enabled or the CNI option is disabled.

metrics-server

capabilities

Metrics Server without default capabilities is not currently supported, but does run as a non-root user by default. Metrics Server exposes container runtime metrics (CPU and memory) that allows user workloads created in Domino to horizontally scale automatically.

mlflow-postgresql-slave

capabilities

PostgreSQL without default capabilities is not currently supported, but does run as a non-root user by default. Will not be installed if MFLow is not configured for Domino during installation.

mlflow

capabilities

MLFlow without default capabilities is not currently supported, but does run as a non-root user by default. Will not be installed if MFLow is not configured for Domino during installation.

mongodb-primary

capabilities

MongoDB without default capabilities is not currently supported, but does run as a non-root user by default.

mongodb-secondary

capabilities

MongoDB without default capabilities is not currently supported, but does run as a non-root user by default.

newrelic-infrastructure

privileged
runAsRoot

Requires access to host node resources in order to effectively monitor CPU, memory, network, and disk usage and report to New Relic. Will not be installed if New Relic is not configured for Domino during installation.

newrelic-infrastructure-monitor-services

capabilities

New Relic Infrastructure monitoring without default capabilities is not currently supported, but does run as a non-root user by default. Will not be installed if New Relic is not configured for Domino during installation.

newrelic-logging

capabilities
runAsRoot

Requires access to host node resources in order to follow container logs and report to New Relic. Will not be installed if New Relic is not configured for Domino during installation.

nfs-client-provisioner

capabilities
runAsRoot

NFS Client Provisioner requires privileged access to filesystem resources in order to manage NFS volumes for Domino. Will not be installed if NFS is not configured as a storage provider during installation.

nvidia-device-plugin

capabilities
runAsRoot

Requires access to host node resources in order to communicate with the Kubernetes device API and expose NVIDIA GPU resources to the cluster. Will not be installed if GPU capabilities are not configuring during installation.

nvidia-driver-installer

privileged
runAsRoot

Requires access to host node resources in order to install and manage NVIDIA drivers for GPU-enabled instance types. Only required for installations on GKE clusters.

openebs

capabilities
runAsRoot

Requires access to host node resources in order to manage storage volumes. Will not be installed if OpenEBS is not configured as a storage provider during installation.

postgresql-slave

capabilities

PostgreSQL without default capabilities is not currently supported, but does run as a non-root user by default.

prometheus-node-exporter

capabilities

Requires access to host node resources in order to effectively monitor CPU, memory, network, and disk usage and report to Prometheus.

seldon-controller-manager

capabilities

Seldon manages model API deployment and processing. Seldon without default capabilities is not currently supported, but does run as a non-root user by default.

shoreline-agent

capabilities
runAsRoot

Requires access to host node resources in order to effectively monitor CPU, memory, network, and disk usage and report back to Shoreline. Will not be installed if Shoreline is not configured for Domino during installation.

smarter-device-manager

runAsRoot

Requires access to host node resources in order to communicate with the Kubernetes device API and expose FUSE devices to the cluster.

starburst-coordinator

capabilities

Starburst allows users to manage and query data sources efficiently. Starburst without default capabilities is not currently supported, but does run as a non-root user by default.

starburst-worker

capabilities

Starburst allows users to manage and query data sources efficiently. Starburst without default capabilities is not currently supported, but does run as a non-root user by default.

In addition, all user-generated pods from workspaces, jobs, models, apps, or on-demand compute clusters run as a root user and with additional capabilities.

Please see Pod Security Policies for an overview of how policies are enforced and specific information about the removal of Pod Security Policies in Kubernetes v1.25.

User Guide

Admin Guide

API Guide

Release Notes

Kubernetes pod security