Security context configuration for Nifi

Cloudera Flow Management Operator for Kubernetes sets hardened security contexts on all pods and containers by default. Three StatefulsetSpec fields let you override pod, main container, and tini container defaults on the Nifi CRD without replacing the operator defaults wholesale.

API fields


Field	Scope	API path
`podSecurityContext`	Pod (all containers)	`spec.statefulset.podSecurityContext`
`containerSecurityContext`	Main application container only (`nifi`)	`spec.statefulset.containerSecurityContext`
`tiniSecurityContext`	Log-tailer sidecars and `kerberize` init container	`spec.statefulset.tiniSecurityContext`

Merge semantics

Each field is applied with Kubernetes strategic-merge-patch semantics (the same algorithm used by kubectl apply):

A field that is set in the override takes precedence over the operator default.
A field that is not set in the override keeps the operator default.
Unsetting a defaulted field is not supported — omitting a field in the override leaves the operator value in place; you cannot remove a field the operator always sets.
List fields (capabilities.add, capabilities.drop) behave atomically: when the override supplies the list, the override list replaces the operator list entirely.

Operator defaults

Pod Security Standards

The default security context settings of Cloudera Flow Management Operator for Kubernetes and NiFi pods are compliant with the restricted Pod Security Standard.

Pod security context

Applied to every pod in the StatefulSet.

runAsNonRoot: true
seccompProfile:
  type: RuntimeDefault
fsGroup: 0          # standard Kubernetes clusters only; omitted on OpenShift

On OpenShift clusters, fsGroup is not set, letting the platform assign the supplemental group automatically. On standard clusters it defaults to 0 (root group) so that volumes are accessible to the NiFi process. Use podSecurityContext.fsGroup to change it.

Main container security context

Applied to the nifi container.

allowPrivilegeEscalation: false
capabilities:
  drop: [ALL]

runAsNonRoot is inherited from the pod security context.

Tini container security context

Applied to the log-tailer sidecar containers and the kerberize init container (when Kerberos is enabled).

runAsNonRoot: true
allowPrivilegeEscalation: false
capabilities:
  drop: [ALL]

NiFi log-tailers: app-log, user-log, bootstrap-log, gc-log, request-log, and deprecation-log.

Examples

Override fsGroup so that the kubelet does not change ownership of shared volumes to root:root, and set a specific UID for the main container and tini containers:

spec:
  statefulset:
    podSecurityContext:
      fsGroup: 1000
    containerSecurityContext:
      runAsUser: 1000
    tiniSecurityContext:
      runAsUser: 1000

A sample patch is provided at config/samples/nifi/patches/pod-security-context.yaml.