# Security (/docs/enterprise/helm/guides/security)



Security configuration for the nbe-operator and NetBox Enterprise deployment.

## RBAC Modes [#rbac-modes]

The operator supports two RBAC scopes controlled by `rbac.scope`:

### Cluster Scope (Default) [#cluster-scope-default]

```yaml
rbac:
  scope: "cluster"
```

* Creates `ClusterRole` and `ClusterRoleBinding`
* Operator watches for `NetBoxEnterprise` resources in **all namespaces**
* Required for multi-namespace deployments

### Namespace Scope [#namespace-scope]

```yaml
rbac:
  scope: "namespace"
```

* Creates `Role` and `RoleBinding` in the release namespace only
* Operator watches only its own namespace
* More restrictive - suitable for shared clusters where namespace isolation is required

## Pod Security [#pod-security]

The operator runs with restrictive security defaults:

| Setting                    | Value   | Description                    |
| -------------------------- | ------- | ------------------------------ |
| `runAsNonRoot`             | `true`  | Container must run as non-root |
| `runAsUser`                | `65532` | UID for the operator process   |
| `fsGroup`                  | `65532` | Filesystem group               |
| `allowPrivilegeEscalation` | `false` | No privilege escalation        |
| `capabilities.drop`        | `[ALL]` | All Linux capabilities dropped |
| `readOnlyRootFilesystem`   | `true`  | Read-only root filesystem      |

These settings comply with the Kubernetes **Restricted** pod security standard.

## TLS Configuration [#tls-configuration]

### Routing TLS [#routing-tls]

Serve NetBox over HTTPS by setting `netbox.urls`; the operator configures TLS on the routing resources it emits (Gateway API routes or Ingress, per the resolved [routing mode](/enterprise/helm/configuration/ingress-tls)):

```yaml
netboxEnterprise:
  spec:
    netbox:
      urls:
        - "https://netbox.example.com"
```

See [Ingress & TLS](/enterprise/helm/configuration/ingress-tls) for certificate setup.

### Database TLS [#database-tls]

Encrypt connections to PostgreSQL using a named profile:

```yaml
netboxEnterprise:
  spec:
    postgresqlProfiles:
      netbox:
        host: "postgres.example.com"
        port: 5432
        tlsConfig:
          sslmode: verify-full
          keychainCaCertificates:
            - postgres-ca
          keychainClientCertificate: postgres-client

    postgresql:
      external: true
      postgresqlProfile: netbox
```

See [PostgreSQL Configuration](/enterprise/helm/configuration/postgresql#tls-configuration) for the full TLS reference.

### Redis TLS [#redis-tls]

Encrypt connections to Redis:

```yaml
netboxEnterprise:
  spec:
    redis:
      external: true
      tlsConfig:
        keychainCaCertificates:
          - redis-ca
```

## Image Pull Secrets [#image-pull-secrets]

Registry credentials for operator and dependency images are automatically injected when installing through the Replicated registry.

For NetBox application images, you can configure additional pull secrets at the NetBoxEnterprise level:

```yaml
netboxEnterprise:
  spec:
    imagePullSecrets:
      - netbox-registry-creds
```

## Secrets Management [#secrets-management]

The operator handles secrets carefully:

* **Auto-generated secrets**: Django secret key, superuser credentials, Hydra secrets are auto-generated if not explicitly provided
* **PGO password rotation**: The operator detects password changes via `resourceVersion` checksums without reading sensitive `data` fields, then triggers rolling updates automatically
* **No secrets in logs**: Sensitive values are never logged

## Network Policies [#network-policies]

The operator does not create NetworkPolicies by default. To restrict traffic, create policies in your namespace:

```yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: netbox-allow-ingress
  namespace: netbox
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: netbox
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              # Namespace of your gateway/ingress controller. The bundled Traefik
              # gateway runs in the release namespace; adjust to match your
              # controller (e.g. a separate ingress-nginx namespace).
              kubernetes.io/metadata.name: netbox
      ports:
        - port: 8080
          protocol: TCP
```

## Next Steps [#next-steps]

* [Troubleshooting](/enterprise/helm/guides/troubleshooting/) - Diagnose RBAC and connectivity issues
* [Helm Values Reference](/enterprise/helm/configuration/helm-values) - Full security-related values