Security and compliance

Security context for UiPath® services

This section provides details on the security context of the UiPath® services.

All UiPath® services are configured with a security context defined in their spec section.

The following sample shows a typical configuration for UiPath® services:

spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
  containers:
    - securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop: ["ALL"]
  hostPID: false
  hostNetwork: false

For some UiPath® services, there are exceptions from the typical security context configuration:

• In the case of the connector-builder-setup-job service, the value of the readOnlyRootFilesystem parameter is false.

In some instances, the user IDs and group IDs can be greater than or equal to 1000, depending on your environment. Make sure you configure the user and group IDs according to your security principles and your organization's security guidelines.

Gatekeeper and OPA policies

Automation Suite is pre-configured with Gatekeeper and OPA policies. If you bring your own Gatekeeper component and OPA policies, you can skip these components from the Automation Suite installation. For details, see Automation Suite stack. In this case, review the OPA policies and the exceptions needed for installing and running Automation Suite.

By default, these policies only run in the following UiPath® namespaces: -uipath, uipath-installer, uipath-infra, airflow, and argocd.

OPA policies

Policy	Enforcement action	Namespaces/Images to be excluded
Allow Privilege Escalation in Container Controls restricting escalation to root privileges. Corresponds to the allowPrivilegeEscalation field in a PodSecurityPolicy	dryrun	gatekeeper logging dapr-system kube-system uipath-check default istio-system cert-manager monitoring
App Armor Configures an allowlist of AppArmor profiles for use by containers. This corresponds to specific annotations applied to a PodSecurityPolicy.	deny	gatekeeper logging dapr-system kube-system default istio-system cert-manager monitoring
Capabilities Controls Linux capabilities on containers. Corresponds to the allowedCapabilities and requiredDropCapabilities fields in a PodSecurityPolicy.	dryrun	gatekeeper logging dapr-system uipath-check kube-system default istio-system cert-manager monitoring
FlexVolumes Controls the allowlist of FlexVolume drivers. Corresponds to the allowedFlexVolumes field in PodSecurityPolicy.	deny	gatekeeper logging dapr-system kube-system default istio-system cert-manager monitoring
Forbidden Sysctls	deny	gatekeeper logging dapr-system kube-system default istio-system cert-manager monitoring
FS Group Controls allocating an FSGroup that owns the pod's volumes. Corresponds to the fsGroup field in a PodSecurityPolicy.	dryrun	gatekeeper logging dapr-system uipath-installer kube-system uipath argocd default istio-system cert-manager monitoring airflow uipath-check
Host Filesystem Controls usage of the host filesystem. Corresponds to the allowedHostPaths field in a PodSecurityPolicy.	dryrun	gatekeeper logging dapr-system kube-system argocd default istio-system cert-manager monitoring
Host Namespace Disallows sharing of host PID and IPC namespaces by pod containers. Corresponds to the hostPID and hostIPC fields in a PodSecurityPolicy.	deny	gatekeeper logging dapr-system kube-system argocd default istio-system cert-manager monitoring
Host Networking Ports Controls usage of host network namespace by pod containers.	deny	gatekeeper logging dapr-system kube-system argocd default istio-system cert-manager monitoring uipath-check
Privileged Container Controls the ability of any container to enable privileged mode. Corresponds to the privileged field in a PodSecurityPolicy.	deny	gatekeeper logging dapr-system kube-system argocd default istio-system cert-manager monitoring uipath-check
Proc Mount Controls the allowed procMount types for the container. Corresponds to the allowedProcMountTypes field in a PodSecurityPolicy.	deny	gatekeeper logging dapr-system kube-system argocd default istio-system cert-manager monitoring
Read Only Root Filesystem Requires the use of a read-only root file system by pod containers.	dryrun	gatekeeper logging dapr-system kube-system argocd default istio-system cert-manager monitoring uipath-check
Seccomp Controls the seccomp profile used by containers. Corresponds to the seccomp.security.alpha.kubernetes.io/allowedProfileNames annotation on a PodSecurityPolicy.	dryrun	gatekeeper logging dapr-system uipath-installer kube-system uipath argocd default istio-system cert-manager monitoring airflow uipath-check
SELinux V2 Defines an allowlist of seLinuxOptions configurations for pod containers.	deny	gatekeeper logging dapr-system kube-system argocd default istio-system cert-manager monitoring
Allowed Users Controls the user and group IDs of the container and some volumes.	dryrun	gatekeeper logging dapr-system uipath-installer kube-system uipath argocd default istio-system cert-manager monitoring airflow velero uipath-check
Volume Types Restricts mountable volume types to those specified by the user.	deny	gatekeeper logging dapr-system kube-system argocd default istio-system cert-manager monitoring velero uipath-check

Note:

• The dapr-system namespace is only needed if you install Process Mining and Task Mining.
• The airflow namespace is only needed if you install Process Mining.

Other OPA policies

Policy	Enforcement action	Namespaces/Images to be excluded
Automount Service Account Token for Pod Controls the ability of any pod to enable automountServiceAccountToken.	dryrun	gatekeeper logging dapr-system uipath-installer kube-system uipath argocd default istio-system cert-manager monitoring airflow uipath-check
Allowed Repositories Requires container images to begin with a string from the specified list.	dryrun	registry.uipath.com registry-data.uipath.com
Block Endpoint Edit Default Role	deny	N/A
Block Services with type LoadBalancer Disallows all services of type LoadBalancer.	deny	kube-system
Block NodePort Disallows all Services of type NodePort.	deny	istio-system network-prereq-checks
Block Wildcard Ingress Users must not able to create Ingresses with a blank or wildcard (*) hostname since that would enable them to intercept traffic for other services in the cluster, even if they do nto have access to those services.	deny	gatekeeper logging dapr-system kube-system argocd default istio-system cert-manager monitoring
Container Limits Requires containers to have memory and CPU limits set. Constrains limits to be within the specified maximum values.	dryrun	gatekeeper logging dapr-system uipath-installer kube-system uipath argocd default istio-system cert-manager monitoring airflow uipath-check
Container Requests Requires containers to have memory and CPU requests set. Constrains requests to be within the specified maximum values.	dryrun	gatekeeper logging dapr-system uipath-installer kube-system uipath argocd default istio-system cert-manager monitoring airflow uipath-check
Container Ratios Sets a maximum ratio for container resource limits to requests.	dryrun	gatekeeper logging dapr-system uipath-installer kube-system uipath argocd default istio-system cert-manager monitoring airflow prereq**
Required Resources Requires containers to have defined resources set.	dryrun	gatekeeper logging dapr-system uipath-installer kube-system uipath argocd default istio-system cert-manager monitoring airflow uipath-check
Disallow Anonymous Access Disallows associating ClusterRole and Role resources to the system:anonymous user and system:unauthenticated group.	deny	N/A
Disallow tags Requires container images to have an image tag different from the ones in the specified list.	deny	N/A
Container ephemeral storage limit Requires containers to have an ephemeral storage limit set and constrains the limit to be within the specified maximum values.	dryrun	gatekeeper logging dapr-system uipath-installer kube-system uipath argocd default istio-system cert-manager monitoring airflow uipath-check
Horizontal Pod Autoscaler	deny	N/A
HTTPS Only Requires Ingress resources to be HTTPS only. Ingress resources must include the kubernetes.io/ingress.allow-http annotation, set to false. By default a valid TLS {} configuration is required, this can be made optional by setting the tlsOptional parameter to true.	dryrun	monitoring
Image Digests Requires container images to contain a digest.	dryrun	uipath
Block updating Service Account Blocks updating the service account on resources that abstract over Pods. This policy is ignored in audit mode.	dryrun	N/A
Pod Disruption Budget	deny	airflow
Required Probes Requires Pods to have readiness and/or liveness probes.	dryrun	uipath
Storage Class Requires storage classes to be specified when used.	dryrun	N/A
Unique Ingress Host Requires all Ingress rule hosts to be unique.	dryrun	N/A
Unique Service Selector Requires Services to have unique selectors within a namespace. Selectors are considered the same if they have identical keys and values. Selectors may share a key/value pair as long as there is at least one distinct key/value pair between them.	dryrun	N/A

Note:

• The dapr-system namespace is only needed if you install Process Mining and Task Mining.
• The airflow namespace is only needed if you install Process Mining.
• prereq** are temporary namespaces created while running a prerequisite or health check. The namespaces self-delete upon completion.

Networking policies

Automation Suite is pre-configured with standard Kubernetes Network Policies to follow the principle of least privilege network access. You can choose to skip installing UiPath-provided network policies by adding network-policies under the exclude components list in input.json. To learn more about optional components, see the Automation Suite stack.

Automation Suite enforces the network from, to, and within the <uipath> namespace. If you bring your own network policies or if you have a custom CNI (e.g., Cilium Enterprise or Calico Tigera Enterprise), make sure to update your policies to mirror the network-policies Helm chart.

You can find the Automation Suite network-policies Helm chart by running the following command.

Note:

• You must replace <automation-suite-version> with your current Automation Suite version in the following command.
• You must unzip the file to extract the Helm chart.

helm pull oci://registry.uipath.com/helm/network-policies --version <automation-suite-version>

Cluster privilege requirements

Cluster admin access is required for uipathctl on your management node to install and manage Automation Suite on your dedicated cluster. This level of access is needed for system-level components in Automation Suite, such as Istio (routing / service mesh) and ArgoCD (deployment and application lifecycle management), and to create Automation Suite-related namespaces.

FIPS 140-2

Federal Information Processing Standards 140-2 (FIPS 140-2) is a security standard that validates the effectiveness of cryptographic modules.

Automation Suite on can run on FIPS 140-2-enabled machines.

You can enable FIPS 140-2 on the machines on which you install Automation Suite in the following scenarios:

1. Enable FIPS 140-2 before performing a clean installation of Automation Suite. This scenario applies to both Automation Suite on EKS and Automation Suite on AKS. For details, see Enabling FIPS 140-2 for new installations.
2. ​Enable FIPS 140-2 after performing an Automation Suite installation on a machine with FIPS-140-2 disabled. For details, see Enabling FIPS 140-2 for existing installations.
   Note: This scenario only applies to Automation Suite on AKS. For Automation Suite on EKS, you cannot enable FIPS 140-2 if you completed an Automation Suite installation with FIPS-140-2 disabled.

Enabling FIPS 140-2 for new installations

To enable FIPS 140-2 on the machines where you plan to perform a fresh installation of Automation Suite, take the following steps:

1. Before starting the Automation Suite installation, enable FIPS 140-2 on your machines.
2. Perform the Automation Suite installation by following the installation instructions in this guide.
   Note:

   • If you install AI Center on a FIPS 140-2-enabled machine and also use Microsoft SQL Server, some additional configuration is required. For details, see SQL requirements for AI Center.

   • Make sure Insights, Integration Service, and Studio Web are disabled, as they are not supported on FIPS 140-2.

3. Set the fips_enabled_nodes flag to true in the input.json file.
4. Make sure your certificates are FIPS 140-2-compatible.
   Note:

   By default, Automation Suite generates self-signed FIPS 140-2-compatible certificates whose expiry date depends on the type of Automation Suite installation you choose.

   We strongly recommend that you replace these self-signed certificates with CA-issued certificates at installation time. To use Automation Suite on FIPS 140-2-enabled machines, the newly provided certificates must be FIPS 140-2-compatible. For a list of eligible ciphers supported by RHEL, see the RHEL documentation.

   For details on how to add your own FIPS 140-2-compliant token-signing and TLS certificates, see Certificate configuration.

5. For Automation Suite on EKS, you must provide the RDS certificate bundle path. You can find the region-specific download links for the RDS certificate bundle in the AWS documentation. Make sure you update the RDS certificate bundle pem file in the input.json configuration file, as shown in the following example:

   {
     ...
     "additional_ca_certs": "certificates/rds-aws-bundle.pem",
     ...
   }

Enabling FIPS 140-2 for existing installations

You can install Automation Suite with FIPS 140-2 disabled, and then enable the security standard on the same machines. This is also possible when you upgrade to a new Automation Suite version.

Important:

You can currently enable FIPS 140-2 for existing installations of Automation Suite on AKS but not for existing installations of Automation Suite on EKS. You can enable FIPS 140-2 for Automation Suite on EKS only before performing a clean Automation Suite installation. For more information, see Enabling FIPS 140-2 for new installations.

To enable FIPS 140-2 on the machines where you already performed an Automation Suite installation, take the following steps:

1. Perform a regular Automation Suite installation or upgrade operation on machines with FIPS 140-2 disabled.
2. Enable FIPS 140-2 on all your machines.
3. Make sure your certificates are FIPS 140-2-compatible.
   Note:

   To use Automation Suite on FIPS 140-2-enabled machines, you must replace your certificates with new FIPS 140-2-compatible certificates signed by a CA. For a list of eligible ciphers supported by RHEL, see RHEL documentation.

   For details on how to add your own FIPS 140-2-compliant token-signing and TLS certificates, see Certificate configuration.

   For more on certificates, see .

4. Make sure your product selection is in line with the FIPS-140-2 requirements:
   • If you install AI Center on a FIPS 140-2-enabled machine and also use Microsoft SQL Server, some additional configuration is required. For details, see SQL requirements for AI Center.
   • If you previously enabled Insights, Integration Service, or Studio Web, you must disable them as they are not supported on FIPS 140-2. For details on how to disable products post-installation, see Managing products.
5. Reboot your machines and check if you successfully enabled FIPS 140-2.
6. Rerun the uipathctl installer.