Permissions

Overview

NGINX Gateway Fabric uses a split-plane architecture with three components that require different permissions:

  • Control Plane: Manages Kubernetes APIs and data plane deployments. Needs broad API access but handles no user traffic.
  • Data Plane: Processes user traffic. Requires minimal permissions since configuration comes from control plane via secure gRPC.
  • Certificate Generator: One-time job that creates TLS certificates for inter-plane communication.

Security Context

All components share these security settings:

  • User ID: 101 (non-root)
  • Group ID: 1001
  • Capabilities: All dropped (drop: ALL)
  • Root Filesystem: Read-only except for specific writable volumes
  • Seccomp: Runtime default profile

Control Plane

Runs as a single container in the nginx-gateway deployment.

Additional Security Settings:

  • Privilege Escalation: Disabled

Volumes:

  • Secret mounts for TLS certificates

RBAC Permissions:

  • Secrets, ConfigMaps, Services: Create, update, delete, list, get, watch
  • Deployments, DaemonSets: Create, update, delete, list, get, watch
  • ServiceAccounts: Create, update, delete, list, get, watch
  • Namespaces, Pods: Get, list, watch
  • Events: Create, patch
  • EndpointSlices: List, watch
  • Gateway API resources: List, watch (read-only) + update status subresources only
  • NGF Custom resources: Get, list, watch (read-only) + update status subresources only
  • Leases: Create, get, update (for leader election)
  • CustomResourceDefinitions: List, watch
  • TokenReviews: Create (for authentication)

Data Plane

NGINX containers managed by the control plane. No RBAC permissions needed since configuration comes via secure gRPC.

Additional Security Settings:

  • Privilege Escalation: Disabled
  • Sysctl: net.ipv4.ip_unprivileged_port_start=0 (enables binding to ports < 1024)

Volumes:

  • EmptyDir volumes for NGINX configuration, runtime files, logs, and cache
  • Secret mounts for TLS certificates and the NGINX Plus JWT token
  • Projected token mounts for service account authentication

Volume Permissions:

  • EmptyDir: Read-write (required for NGINX operation)
  • Secret/ConfigMap/Projected: Read-only

Certificate Generator

Kubernetes Job that creates initial TLS certificates.

RBAC Permissions:

  • Secrets: Create, update, get (control plane namespace only)

Platform-Specific Considerations

OpenShift Compatibility

NGINX Gateway Fabric includes Security Context Constraints (SCCs) for OpenShift:

Control Plane SCC:

  • Privilege Escalation: Disabled
  • Host Access: Disabled (network, IPC, PID, ports)
  • User ID Range: 101-101 (fixed)
  • Group ID Range: 1001-1001 (fixed)
  • Volumes: Secret only

Data Plane SCC: Same restrictions as control plane, plus additional volume types:

  • Additional Volumes: EmptyDir, ConfigMap, Projected

Linux Capabilities

NGINX Gateway Fabric drops ALL Linux capabilities and adds none, following security best practices.

How It Works Without Capabilities:

  • Process Management: Standard Unix signals (no elevated privileges needed)
  • Port Binding: Uses sysctl net.ipv4.ip_unprivileged_port_start=0 for ports < 1024
  • File Operations: Volume mounts provide necessary write access

Security Features

  • Separation of concerns: Control plane (API access, no traffic) vs data plane (traffic, no API access)
  • Non-root execution: All components run as unprivileged user (UID 101)
  • Zero capabilities: All Linux capabilities dropped
  • Read-only root filesystem: Prevents runtime modifications
  • Ephemeral storage: Temporary volumes only, no persistent storage
  • Least privilege RBAC: Minimal required permissions per component
  • Secure communication: mTLS-encrypted gRPC (TLS 1.3+) between planes