Automation Suite on OpenShift installation guide

Security context for UiPath® services​

spec:
  securityContext:
    runAsNonRoot: true
  containers:
    - securityContext:
        allowPrivilegeEscalation: false
        privileged: false
        readOnlyRootFilesystem: true
        capabilities:
          drop: ["ALL"]
  hostPID: false
  hostNetwork: false
spec:
  securityContext:
    runAsNonRoot: true
  containers:
    - securityContext:
        allowPrivilegeEscalation: false
        privileged: false
        readOnlyRootFilesystem: true
        capabilities:
          drop: ["ALL"]
  hostPID: false
  hostNetwork: false

• Insights has multiple features that use the Chromium Linux SUID Sandbox. While elevated access is not required for installing Insights, it is essential for specific feature functionality. For more information, see Configuring the Insights custom security context.
• Process Mining uses the following Airflow services whose security context differs from the typical configuration for UiPath® services:
  • The statsd service, as shown in the following sample:
    assignment

    securityContext:
        runAsUser: 65534
        seLinuxOptions:
          level: s0:c27,c4
    securityContext:
        runAsUser: 65534
        seLinuxOptions:
          level: s0:c27,c4
    

  • The scheduler, webserver, and other Airflow pods, as shown in the following sample:
    assignment

      securityContext:
        fsGroup: 1000
        runAsGroup: 1000
        runAsNonRoot: true
        runAsUser: 50000
        seLinuxOptions:
          level: s0:c27,c4
        supplementalGroups:
          - 1000
      securityContext:
        fsGroup: 1000
        runAsGroup: 1000
        runAsNonRoot: true
        runAsUser: 50000
        seLinuxOptions:
          level: s0:c27,c4
        supplementalGroups:
          - 1000
    

  • The dynamic runtime pod, as shown in the following sample:
    assignment

      securityContext:
        fsGroup: 1000
        runAsGroup: 1000
        runAsNonRoot: true
        runAsUser: 1001
        seLinuxOptions:
          level: s0:c27,c4
        supplementalGroups:
          - 1000
      securityContext:
        fsGroup: 1000
        runAsGroup: 1000
        runAsNonRoot: true
        runAsUser: 1001
        seLinuxOptions:
          level: s0:c27,c4
        supplementalGroups:
          - 1000
    

Networking policies​

Cluster privilege requirements​

FIPS 140-2​

Enabling FIPS 140-2 for new installations​

1. Before starting the Automation Suite installation, enable FIPS 140-2 on your machines.

2. Perform the Automation Suite installation by following the installation instructions in this guide.

   Note:

   • If you install AI Center on a FIPS 140-2-enabled machine and also use Microsoft SQL Server, some additional configuration is required. For details, see SQL requirements for AI Center.
   • Make sure Insights is disabled, as it is not supported on FIPS 140-2. If you need to use Insights, you can deploy it on a dedicated non-FIPS node. For details, refer to How to deploy Insights in a FIPS-enabled cluster.

3. Set the fips_enabled_nodes flag to true in the input.json file.

4. Make sure your certificates are FIPS 140-2-compatible.

   Note:

   By default, Automation Suite generates self-signed FIPS 140-2-compatible certificates whose expiry date depends on the type of Automation Suite installation you choose.

   We strongly recommend that you replace these self-signed certificates with CA-issued certificates at installation time. To use Automation Suite on FIPS 140-2-enabled machines, the newly provided certificates must be FIPS 140-2-compatible. For a list of eligible ciphers supported by RHEL, see the RHEL documentation.

   For details on how to add your own FIPS 140-2-compliant token-signing and TLS certificates, see Certificate configuration.