- Overview
- Requirements
- Pre-installation
- Installation
- Post-installation
- Migration and upgrade
- Upgrading Automation Suite
- Migrating standalone products to Automation Suite
- Step 1: Restoring the standalone product database
- Step 2: Updating the schema of the restored product database
- Step 3: Moving the Identity organization data from standalone to Automation Suite
- Step 4: Backing up the platform database in Automation Suite
- Step 5: Merging organizations in Automation Suite
- Step 6: Updating the migrated product connection strings
- Step 7: Migrating standalone Orchestrator
- Step 8: Migrating standalone Insights
- Step 9: Deleting the default tenant
- Performing a single tenant migration
- Migrating between Automation Suite clusters
- Migrating from Automation Suite on EKS/AKS to Automation Suite on OpenShift
- Monitoring and alerting
- Cluster administration
- Product-specific configuration
- Troubleshooting
- The backup setup does not work due to a failure to connect to Azure Government
- Pods in the uipath namespace stuck when enabling custom node taints
- Unable to launch Automation Hub and Apps with proxy setup
- Robot cannot connect to an Automation Suite Orchestrator instance
- Log streaming does not work in proxy setups
- Velero backup fails with FailedValidation error
- Accessing FQDN returns RBAC: access denied error
Automation Suite on EKS/AKS installation guide
This section provides details on the security context of the UiPath® services.
spec section.
The following sample shows a typical configuration for UiPath® services:
spec:
securityContext:
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
fsGroup: 1000
containers:
- securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop: ["ALL"]
hostPID: false
hostNetwork: falsespec:
securityContext:
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
fsGroup: 1000
containers:
- securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop: ["ALL"]
hostPID: false
hostNetwork: falseFor some UiPath® services, there are exceptions from the typical security context configuration:
-
In the case of the
connector-builder-setup-jobservice, the value of thereadOnlyRootFilesystemparameter isfalse.
In some instances, the user IDs and group IDs can be greater than or equal to 1000, depending on your environment. Make sure you configure the user and group IDs according to your security principles and your organization's security guidelines.
Automation Suite is pre-configured with Gatekeeper and OPA policies. If you bring your own Gatekeeper component and OPA policies, you can skip these components from the Automation Suite installation. For details, see Automation Suite stack. In this case, review the OPA policies and the exceptions needed for installing and running Automation Suite.
-uipath, uipath-installer, uipath-infra, airflow, and argocd.OPA policies
|
Policy |
Enforcement action |
Namespaces/Images to be excluded |
|---|---|---|
|
Controls restricting escalation to root privileges. Corresponds to the
allowPrivilegeEscalation field in a PodSecurityPolicy
|
|
|
|
Configures an allowlist of AppArmor profiles for use by containers. This corresponds to specific annotations applied to a PodSecurityPolicy. |
|
|
|
Controls Linux capabilities on containers. Corresponds to the
allowedCapabilities and requiredDropCapabilities fields in a PodSecurityPolicy.
|
|
|
|
Controls the allowlist of FlexVolume drivers. Corresponds to the
allowedFlexVolumes field in PodSecurityPolicy.
|
|
|
|
|
| |
|
Controls allocating an FSGroup that owns the pod's volumes. Corresponds to the
fsGroup field in a PodSecurityPolicy.
|
|
|
|
Controls usage of the host filesystem. Corresponds to the
allowedHostPaths field in a PodSecurityPolicy.
|
|
|
|
Disallows sharing of host PID and IPC namespaces by pod containers. Corresponds to the
hostPID and hostIPC fields in a PodSecurityPolicy.
|
|
|
|
Controls usage of host network namespace by pod containers. |
|
|
|
Controls the ability of any container to enable privileged mode. Corresponds to the
privileged field in a PodSecurityPolicy.
|
|
|
|
Controls the allowed
procMount types for the container. Corresponds to the allowedProcMountTypes field in a PodSecurityPolicy.
|
|
|
|
Requires the use of a read-only root file system by pod containers. |
|
|
|
Controls the seccomp profile used by containers. Corresponds to the
seccomp.security.alpha.kubernetes.io/allowedProfileNames annotation on a PodSecurityPolicy.
|
|
|
|
Defines an allowlist of seLinuxOptions configurations for pod containers. |
|
|
|
Controls the user and group IDs of the container and some volumes. |
|
|
|
Restricts mountable volume types to those specified by the user. |
|
|
-
The
dapr-systemnamespace is only needed if you install Process Mining and Task Mining. -
The
airflownamespace is only needed if you install Process Mining.
Other OPA policies
|
Policy |
Enforcement action |
Namespaces/Images to be excluded |
|---|---|---|
|
Controls the ability of any pod to enable
automountServiceAccountToken.
|
|
|
|
Requires container images to begin with a string from the specified list. |
|
|
|
|
|
N/A |
|
Disallows all services of type LoadBalancer. |
|
|
|
Disallows all Services of type NodePort. |
|
|
|
Users must not able to create Ingresses with a blank or wildcard (*) hostname since that would enable them to intercept traffic for other services in the cluster, even if they do nto have access to those services. |
|
|
|
Requires containers to have memory and CPU limits set. Constrains limits to be within the specified maximum values. |
|
|
|
Requires containers to have memory and CPU requests set. Constrains requests to be within the specified maximum values. |
|
|
|
Sets a maximum ratio for container resource limits to requests. |
|
|
|
Requires containers to have defined resources set. |
|
|
|
Disallows associating ClusterRole and Role resources to the
system:anonymous user and system:unauthenticated group.
|
|
N/A |
|
Requires container images to have an image tag different from the ones in the specified list. |
|
N/A |
|
Requires containers to have an ephemeral storage limit set and constrains the limit to be within the specified maximum values. |
|
|
|
|
|
N/A |
|
Requires Ingress resources to be HTTPS only. Ingress resources must include the
kubernetes.io/ingress.allow-http annotation, set to false. By default a valid TLS {} configuration is required, this can be made optional by setting the tlsOptional parameter to true.
|
|
|
|
Requires container images to contain a digest. |
|
|
|
Blocks updating the service account on resources that abstract over Pods. This policy is ignored in audit mode. |
|
N/A |
|
|
|
|
|
Requires Pods to have readiness and/or liveness probes. |
|
|
|
Requires storage classes to be specified when used. |
|
N/A |
|
Requires all Ingress rule hosts to be unique. |
|
N/A |
|
Requires Services to have unique selectors within a namespace. Selectors are considered the same if they have identical keys and values. Selectors may share a key/value pair as long as there is at least one distinct key/value pair between them. |
|
N/A |
-
The
dapr-systemnamespace is only needed if you install Process Mining and Task Mining. -
The
airflownamespace is only needed if you install Process Mining. -
prereq**are temporary namespaces created while running a prerequisite or health check. The namespaces self-delete upon completion.
network-policies under the exclude components list in input.json. To learn more about optional components, see the Automation Suite stack.
network-policies Helm chart.
network-policies Helm chart by running the following command.
- You must replace
<automation-suite-version>with your current Automation Suite version in the following command. - You must unzip the file to extract the Helm chart.
helm pull oci://registry.uipath.com/helm/network-policies --version <automation-suite-version>helm pull oci://registry.uipath.com/helm/network-policies --version <automation-suite-version>uipathctl on your management node to install and manage Automation Suite on a dedicated cluster. This level of access is needed for
system-level components in Automation Suite, such as Istio (routing / service mesh) and ArgoCD (deployment and application
lifecycle management), and to create Automation Suite-related namespaces. For shared clusters, admin privileges are not required.
Federal Information Processing Standards 140-2 (FIPS 140-2) is a security standard that validates the effectiveness of cryptographic modules.
Automation Suite on can run on FIPS 140-2-enabled machines.
You can enable FIPS 140-2 on the machines on which you install Automation Suite in the following scenarios:
- Enable FIPS 140-2 before performing a clean installation of Automation Suite. This scenario applies to both Automation Suite on EKS and Automation Suite on AKS. For details, see Enabling FIPS 140-2 for new installations.
- Enable FIPS
140-2 after performing an Automation Suite installation on a machine with FIPS-140-2
disabled. For details, see Enabling FIPS 140-2 for existing installations.
Note: This scenario only applies to Automation Suite on AKS. For Automation Suite on EKS, you cannot enable FIPS 140-2 if you completed an Automation Suite installation with FIPS-140-2 disabled.
Enabling FIPS 140-2 for new installations
To enable FIPS 140-2 on the machines where you plan to perform a fresh installation of Automation Suite, take the following steps:
Enabling FIPS 140-2 for existing installations
You can install Automation Suite with FIPS 140-2 disabled, and then enable the security standard on the same machines. This is also possible when you upgrade to a new Automation Suite version.
You can currently enable FIPS 140-2 for existing installations of Automation Suite on AKS but not for existing installations of Automation Suite on EKS. You can enable FIPS 140-2 for Automation Suite on EKS only before performing a clean Automation Suite installation. For more information, see Enabling FIPS 140-2 for new installations.
To enable FIPS 140-2 on the machines where you already performed an Automation Suite installation, take the following steps:
