Skip to Content
InstallationHelm ConfigurationSecurity Context

Security Context

global:
  securityContext: {}
  #    runAsNonRoot: true
  #    runAsUser: 65534
  #    runAsGroup: 65534
  #    fsGroup: 65534
 
  containerSecurityContext: {}
  #    readOnlyRootFilesystem: true
 
# Override global security context for specific components
dashboard:
  securityContext: {}
  containerSecurityContext: {}
 
recommender:
  securityContext: {}
  containerSecurityContext: {}
 
agent:
  securityContext: {}
  containerSecurityContext: {}
 
admissions:
  securityContext: {}
  containerSecurityContext: {}
 
updater:
  securityContext: {}
  containerSecurityContext: {}
 
prometheus:
  server:
    securityContext: {}
    containerSecurityContext: {}
 
  kube-state-metrics:
    securityContext: {}
    containerSecurityContext: {}
 
networkMonitor:
  securityContext: {}
  containerSecurityContext: {}
 
dcgmExporter:
  securityContext: {}
  containerSecurityContext: {}
 
injectors:
  containerSecurityContext: {}

Read-Only Root Filesystem

When you run ScaleOps with readOnlyRootFilesystem: true, the agent and dashboard still need a writable /tmp directory at runtime for caching and internal processing.

To support this, ScaleOps automatically mounts a writable emptyDir volume at /tmp on the agent and dashboard whenever the effective container security context has readOnlyRootFilesystem: true.

⚠️

Only disable the /tmp volume if that path is already writable through another mechanism — such as your own mounted volume. Otherwise the agent and dashboard will fail on a read-only root filesystem.

Configuring the /tmp volume

The /tmp volume is controlled by global.tmpVolume, with optional per-component overrides on the agent and dashboard. You can disable it or customize the underlying emptyDir spec (for example to set a sizeLimit or back it with Memory):

tmpVolume settings only take effect when readOnlyRootFilesystem: true is set.

global:
  containerSecurityContext:
    readOnlyRootFilesystem: true
  tmpVolume:
    # enabled: true            # set to false to opt out of the writable /tmp volume
    emptyDir:
      sizeLimit: 1Gi           # any emptyDir spec is supported (e.g. medium: Memory)
 
# Per-component overrides (agent and dashboard only)
agent:
  tmpVolume:
    enabled: false             # opt this component out of the writable /tmp volume
 
dashboard:
  tmpVolume:
    emptyDir:
      medium: Memory           # override the emptyDir spec for a single component
FieldDescriptionDefault
global.tmpVolume.enabledOnly effective when readOnlyRootFilesystem: true. Whether to mount the writable /tmp volume. Set to false to opt out.true
global.tmpVolume.emptyDirOnly effective when readOnlyRootFilesystem: true. The emptyDir spec applied to the /tmp volume (e.g. sizeLimit, medium).{}
agent.tmpVolume / dashboard.tmpVolumePer-component override of enabled and/or emptyDir, merged over the global value. Only effective when readOnlyRootFilesystem: true.{}
Scheduling ConstraintsReference