# Linkerd, RKE2 CIS profile - securityContext

**URL:** <https://linkerd.buoyant.io/t/linkerd-rke2-cis-profile-securitycontext/780>\
**Category:** Linkerd General Discussion\
**Tags:** configuration\
**Created:** [June 27, 2025, 9:41am UTC](https://linkerd.buoyant.io/t/linkerd-rke2-cis-profile-securitycontext/780 "2025-06-27T09:41:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![raggeler](https://avatars.discourse-cdn.com/v4/letter/r/b38774/32.png) [@raggeler](https://linkerd.buoyant.io/u/raggeler)\
**Post date:** [June 27, 2025, 9:41am UTC](https://linkerd.buoyant.io/t/linkerd-rke2-cis-profile-securitycontext/780/1 "2025-06-27T09:41:59Z")

</div>

Hi

I am trying to get Linkerd working on an RKE2 CIS profile configured cluster. That means that everything is in a non-root environment and that most privilege access is denied.  
I have seen that the linkerd namespace got privilege access from the install (which is fine I guess), but sidecar’ed pods cannot start because the `linkerd-init` container includes `NET_ADMIN` and `NET_RAW` capabilities.  
Obviously I would not want to raise every namespace that is using Linkerd with elevated privileges. There used to be PSPs in older versions of Kubernetes and there was a way around that issue at the time. But PSPs are deprecated and I could not find any information on how to navigate that issue with todays Kubernetes version…

---

<div class="post-metadata">

**Author:** ![Flynn](https://yyz1.discourse-cdn.com/flex029/user_avatar/linkerd.buoyant.io/flynn/32/41_2.png) [@Flynn](https://linkerd.buoyant.io/u/Flynn)\
**Post date:** [June 27, 2025, 2:23pm UTC](https://linkerd.buoyant.io/t/linkerd-rke2-cis-profile-securitycontext/780/2 "2025-06-27T14:23:33Z")

</div>

You’ll probably need to use the Linkerd CNI plugin instead of the `linkerd-init` container. Check out [CNI Plugin | Linkerd](https://linkerd.io/2.18/features/cni/) and see if that helps you!

---

<div class="post-metadata">

**Author:** ![raggeler](https://avatars.discourse-cdn.com/v4/letter/r/b38774/32.png) [@raggeler](https://linkerd.buoyant.io/u/raggeler)\
**Post date:** [June 27, 2025, 7:12pm UTC](https://linkerd.buoyant.io/t/linkerd-rke2-cis-profile-securitycontext/780/3 "2025-06-27T19:12:19Z")

</div>

Oh, I was not aware of that, awesome! I will check it out. Many thanks 🙂