cleanstart/tigera-operator repository overview

Container Documentation for Tigera-Operator

Tigera Operator is an enterprise-grade Kubernetes operator that manages the installation, upgrade, and configuration of Calico networking and network security components. It provides automated deployment and lifecycle management of Calico's core networking and security features, including network policies, BGP configuration, and IP address management.

📌 Base Foundation: Security-hardened, minimal base OS designed for enterprise containerized environments from {Registry.Example} Registry.

Key Features Core capabilities and strengths of this container

• Automated deployment and management of Calico networking
• Network policy enforcement and security controls
• BGP routing and IP address management
• Zero-downtime upgrades and configuration updates

Common Use Cases Typical scenarios where this container excels

• Kubernetes cluster networking management
• Network security policy enforcement
• Multi-cluster networking orchestration
• Cloud-native network operations

Pull Latest Image Download the container image from the registry

docker pull cleanstart/tigera-operator:latest

docker pull cleanstart/tigera-operator:latest-dev

Basic Run Run the container with basic configuration

docker run -it --name tigera-operator-test cleanstart/tigera-operator:latest-dev

Production Deployment Deploy with production security settings

docker run -d --name tigera-operator-prod \
  --read-only \
  --security-opt=no-new-privileges \
  --user 1000:1000 \
 cleanstart/tigera-operator:latest

Volume Mount Mount local directory for persistent data

docker run -v $(pwd)/data:/data cleanstart/tigera-operator:latest

Port Forwarding Run with custom port mappings

docker run -p 9443:9443 cleanstart/tigera-operator:latest

Environment Variables Configuration options available through environment variables

Security Best Practices Recommended security configurations and practices

• Use RBAC policies to limit operator permissions
• Enable network policies to secure operator communication
• Regularly update to latest security patches
• Configure resource quotas and limits
• Use secure communication channels (TLS)
• Implement proper audit logging
• Monitor operator activities and alerts
• Follow principle of least privilege

Kubernetes Security Context Recommended security context for Kubernetes deployments

securityContext:
  runAsNonRoot: true
  runAsUser: 1000
  runAsGroup: 1000
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false
  capabilities:
    drop: ["ALL"]
    add: ["NET_ADMIN", "NET_RAW"]

Multi-Platform Images

docker pull --platform linux/amd64 cleanstart/tigera-operator:latest
docker pull --platform linux/arm64 cleanstart/tigera-operator:latest

⁠Documentation Resources

Essential links and resources for further information

CleanStart Images: https://images.cleanstart.com/⁠

Community Images:
Docker Hub: https://hub.docker.com/u/cleanstart⁠
GitHub: https://github.com/cleanstart-containers⁠
AWS ECR Public Gallery: https://gallery.ecr.aws/cleanstart/⁠

Presence on Social Media:
Community: https://www.linkedin.com/groups/18324021/⁠
YouTube: https://www.youtube.com/@CleanStartOfficial⁠

Contribute to Container Use Cases: https://github.com/cleanstart-dev/cleanstart-use-cases/⁠

Vulnerability Disclaimer

CleanStart offers Docker images that include third-party open-source libraries and packages maintained by independent contributors. While CleanStart maintains these images and applies industry-standard security practices, it cannot guarantee the security or integrity of upstream components beyond its control.

Users acknowledge and agree that open-source software may contain undiscovered vulnerabilities or introduce new risks through updates. CleanStart shall not be liable for security issues originating from third-party libraries, including but not limited to zero-day exploits, supply chain attacks, or contributor-introduced risks.

Security remains a shared responsibility: CleanStart provides updated images and guidance where possible, while users are responsible for evaluating deployments and implementing appropriate controls.