chapter: Security settings

text:
You can set the security options per *component*, per *instance* or per *environment*.
The priority is:
1. component
2. instance
3. environment
It is recommended to set the security per environment to make sure you do not forget a component.


chapter: Illumio

text:
Example `environment` setting for Illumio:
```
global:
environment:
security:
illumio:
enabled: true
loc: "mylocation"
supplier: "mysupplier"
platform: "myplatform"
readinessGates:
- conditionType: "com.illumio.policy-ready"
```


chapter: CNI, such as Calico or Cilium

text:
Example `environment` setting for CNI:
```
global:
environment:
security:
cni:
defaultIngressPolicy: deny
defaultEgressPolicy: deny
createNetworkPolicy: true
excludeUnusedPorts: false
```
**excludeUnusedPorts** can add a port config to your ingress rules. However, not every CNI is capable of all Attributes (like `EndPort` is currently not supported by cilium).
So you can switch this off, if your CNI does not support it.


chapter: zeroTrust Policy

text:
Some Tools like Cilium transparently encrypt the Node to Node traffic in a Cluster. If you, however, want to aditionally deny all http traffic within a node, you can
enable `zeroTrust` by setting:
```
global:
security:
zeroTrust: true
```
Please make sure you also set all backendProtocols to https. For a complete example, please see the sample values file `zerotrust.yaml` in the samples directory.


chapter: Encrypted backend

text:
An optional approach to zeroTrust (see above) is to set the backenProtocol to http. This leaves the http ports available (zeroTrust would not),
but switches the component backend traffic to https (for ingress, probes, ...).
It is not as strict as zeroTrust and can be set per component like this:
```
ingress:
backendProtocol: https
```
Please see the example file `encrypt.yaml` in the samles directory for more information.


chapter: Security Context

text:
You can add a `containerSecurityContext` to the component by adding it in the values file:
```
security:
containerSecurityContext:
capabilities:
drop: ["ALL"]
```
Additionally, add a `podSecurityContext` if desired:
```
security:
podSecurityContext:
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
```
> **Note**: This setting can not be set on instance or environment level.