Skip to main content
Pod Security Admission (PSA) grades a namespace at one of three levels — privileged, baseline, or restricted — and rejects pods that exceed it. This page records the strictest level each FalkorDB Enterprise namespace actually reaches, and names the specific workloads that stop it going further. Every level below is measured against a real cluster rather than assumed, using scripts/measure-pod-security.sh. The k3d-sanity CI job re-runs that script on every chart change for the release namespace and kb-system, so a regression in either of those two fails the build. That cluster has two nodes, so the installer leaves the bundled csi-hostpath-driver off and CI asserts the release namespace at restricted. The database row is not asserted in CI — k3d-sanity creates no database — so re-measure that yourself with the script if you depend on it.

​
What the installer applies

scripts/install.sh labels the release namespace with enforce=baseline, audit=restricted, and warn=restricted. Enforcement is set to the level that works with every subchart enabled, including the optional dm-sql-to-falkordb; audit and warn are set one notch tighter so that the workloads already capable of restricted are not silently allowed to regress, and so any gap shows up in the audit log. Override any of the three with --pod-security-enforce, --pod-security-audit, and --pod-security-warn. The installer raises enforce to privileged for you when a bundled CSI driver is enabled, because the driver’s Pods need it and would otherwise be rejected by admission before they are ever created:
  • csi-hostpath-driver, when the installer detects a non-CSI default StorageClass on a single-node cluster and enables the driver itself.
  • csi-s3 and csi-nfs, when your values enable them, on this run or a previous one.
An explicit --pod-security-enforce is respected instead (with a warning if it is looser than privileged). Later runs keep the namespace’s current enforce level, so a level set by an earlier run doesn’t have to be passed again. To change it, pass --pod-security-enforce. Disabling a CSI driver doesn’t lower the level by itself; pass --pod-security-enforce baseline on that run. The installer keeps the level, not whether you chose it explicitly. While a bundled CSI driver is enabled, a run without --pod-security-enforce raises a kept baseline or restricted level to privileged. To keep a stricter level anyway (with the warning above), pass --pod-security-enforce on every run.

​
Measured levels

Enabling a CSI driver drops the release namespace to privileged, not some separate CSI namespace — the CSI subcharts are part of the umbrella chart and install alongside the Admin Server. If you need the release namespace at baseline, install the CSI driver as its own release in its own namespace instead of enabling the bundled subchart.

​
Why each namespace is capped where it is

​
Release namespace — restricted

The four workloads the chart owns itself pass restricted:
  • admin-server
  • admin-ui
  • the browser-encryption-key job
  • the preflight job
They run as non-root, drop all capabilities, set seccompProfile: RuntimeDefault, disallow privilege escalation, and mount a read-only root file system. So does falkordb-browser: from 2.6.0 its subchart runs as non-root, drops all capabilities, disallows privilege escalation and sets seccompProfile: RuntimeDefault (it used to ship empty security contexts, which held the namespace at baseline; falkordb-browser#2054). The installer still enforces baseline here. The optional dm-sql-to-falkordb subchart, which installs into this namespace, falls short of restricted (see Optional subcharts), so enforcing restricted by default would reject its pods when it is enabled. If you don’t enable it, you can pass --pod-security-enforce restricted.

​
Release namespace with CSI — privileged

The bundled CSI drivers are off by default. Each one needs privileged, and for reasons inherent to how CSI works rather than anything the chart could fix: A node-level CSI driver has to enter the kubelet mount namespace to attach volumes, so no securityContext change can bring these to baseline.

​
kb-system — baseline

KubeBlocks installs as a separate Helm release into kb-system. Both its Deployments — the manager and the dataprotection controller — are reported under restricted for allowPrivilegeEscalation != false, unrestricted capabilities, and a missing seccompProfile, on both their tools initContainer and their main container. Neither uses a host namespace, a hostPath volume, or privileged, so baseline is clean. snapshot-controller, which the installer also puts in kb-system, has the same shape: clean at baseline, short of restricted on allowPrivilegeEscalation and seccompProfile.

​
Database namespaces — baseline

Database pods are created by KubeBlocks from the ComponentDefinition resources in the FalkorDB addon, not by this chart. Those definitions set no securityContext at all, so the resulting falkordb, falkordb-cluster, and falkordb-sentinel pods are reported under restricted for allowPrivilegeEscalation != false, unrestricted capabilities, runAsNonRoot != true, and a missing seccompProfile. They pass baseline unchanged.

​
Verifying on your own cluster

scripts/measure-pod-security.sh asks the API server which PSA level each namespace’s running pods would pass, without changing anything:
The example above matches a default install. With a bundled CSI driver enabled, for example csi-hostpath-driver on a single-node cluster whose default StorageClass is not CSI-capable, the release namespace measures privileged instead. The script labels each namespace with --dry-run=server, so nothing is persisted. The API server evaluates every pod in the namespace and returns the violations, which the script attributes back to individual pods.

​
Optional subcharts

dm-sql-to-falkordb is off by default and reaches baseline when enabled; it falls short of restricted on allowPrivilegeEscalation, capabilities, runAsNonRoot, and seccompProfile. Enabling it drops the release namespace from restricted to baseline, which the installer’s default enforce level already allows.