Permissions

Overview

NGINX Gateway Fabric uses a split-plane architecture with three components that require different permissions:

• Control Plane: Manages Kubernetes APIs and data plane deployments. Needs broad API access but handles no user traffic.
• Data Plane: Processes user traffic. Requires minimal permissions since configuration comes from control plane via secure gRPC.
• Certificate Generator: One-time job that creates TLS certificates for inter-plane communication.

Security Context

All components share these security settings:

• User ID: 101 (non-root)
• Group ID: 1001
• Capabilities: All dropped (drop: ALL)
• Root Filesystem: Read-only except for specific writable volumes
• Seccomp: Runtime default profile

Control Plane

Runs as a single container in the nginx-gateway deployment.

Additional Security Settings:

• Privilege Escalation: Disabled

Volumes:

• Secret mounts for TLS certificates

RBAC Permissions:

• Secrets, ConfigMaps, Services: Create, update, delete, list, get, watch
• Deployments, DaemonSets: Create, update, delete, list, get, watch
• ServiceAccounts: Create, update, delete, list, get, watch
• Namespaces, Pods: Get, list, watch
• Events: Create, patch
• EndpointSlices: List, watch
• Gateway API resources: List, watch (read-only) + update status subresources only
• NGF Custom resources: Get, list, watch (read-only) + update status subresources only
• Leases: Create, get, update (for leader election)
• CustomResourceDefinitions: List, watch
• TokenReviews: Create (for authentication)

Data Plane

NGINX containers managed by the control plane. No RBAC permissions needed since configuration comes via secure gRPC.

Additional Security Settings:

• Privilege Escalation: Disabled
• Sysctl: net.ipv4.ip_unprivileged_port_start=0 (enables binding to ports < 1024)

Volumes:

• EmptyDir volumes for NGINX configuration, runtime files, logs, and cache
• Secret mounts for TLS certificates and the NGINX Plus JWT token
• Projected token mounts for service account authentication

Volume Permissions:

• EmptyDir: Read-write (required for NGINX operation)
• Secret/ConfigMap/Projected: Read-only

Certificate Generator

Kubernetes Job that creates initial TLS certificates.

RBAC Permissions:

• Secrets: Create, update, get (control plane namespace only)

Platform-Specific Considerations

OpenShift Compatibility

NGINX Gateway Fabric includes Security Context Constraints (SCCs) for OpenShift:

Control Plane SCC:

• Privilege Escalation: Disabled
• Host Access: Disabled (network, IPC, PID, ports)
• User ID Range: 101-101 (fixed)
• Group ID Range: 1001-1001 (fixed)
• Volumes: Secret only

Data Plane SCC: Same restrictions as control plane, plus additional volume types:

• Additional Volumes: EmptyDir, ConfigMap, Projected

Linux Capabilities

NGINX Gateway Fabric drops ALL Linux capabilities and adds none, following security best practices.

How It Works Without Capabilities:

• Process Management: Standard Unix signals (no elevated privileges needed)
• Port Binding: Uses sysctl net.ipv4.ip_unprivileged_port_start=0 for ports < 1024
• File Operations: Volume mounts provide necessary write access

Security Features

• Separation of concerns: Control plane (API access, no traffic) vs data plane (traffic, no API access)
• Non-root execution: All components run as unprivileged user (UID 101)
• Zero capabilities: All Linux capabilities dropped
• Read-only root filesystem: Prevents runtime modifications
• Ephemeral storage: Temporary volumes only, no persistent storage
• Least privilege RBAC: Minimal required permissions per component
• Secure communication: mTLS-encrypted gRPC (TLS 1.3+) between planes