Security hardening guide for scheduler configuration #45080

AnshumanTripathi · 2024-02-10T08:07:00Z

Creating a scheduler hardening guide as a part of kubernetes/sig-security#30.

Page preview - https://deploy-preview-45080--kubernetes-io-main-staging.netlify.app/docs/concepts/security/hardening-guide/scheduler/

linux-foundation-easycla · 2024-02-10T08:07:06Z

The committers listed above are authorized under a signed CLA.

✅ login: AnshumanTripathi / name: Anshuman Tripathi (0b307ff, dda9966)

k8s-ci-robot · 2024-02-10T08:07:08Z

Welcome @AnshumanTripathi!

It looks like this is your first PR to kubernetes/website 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/website has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

netlify · 2024-02-10T08:09:24Z

✅ Pull request preview available for checking

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`dda9966`
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/67319b3c15ec33000825b023
😎 Deploy Preview	https://deploy-preview-45080--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

sftim · 2024-02-10T17:51:55Z

/sig security

content/en/docs/concepts/security/hardening-guide/scheduler.md

reylejano · 2024-02-13T19:11:21Z

@kubernetes/sig-security-pr-reviews please take a look

content/en/docs/concepts/security/hardening-guide/scheduler.md

sftim

Some more feedback.

content/en/docs/concepts/security/hardening-guide/scheduler.md

sftim · 2024-05-12T01:39:23Z

@kubernetes/sig-security-pr-reviews please take a look at this one. SIG Scheduling can confirm details where appropriate.

sftim

I think we could clarify what we mean by “configurations”. Did you mean command line settings?

content/en/docs/concepts/security/hardening-guide/scheduler.md

Signed-off-by: Anshuman Tripathi <[email protected]> [WIP] Security hardening guide for scheduler configurations Signed-off-by: Anshuman Tripathi <[email protected]> Updates after passing through hemmingway.app Signed-off-by: Anshuman Tripathi <[email protected]> Update scheduling configurations Signed-off-by: Anshuman Tripathi <[email protected]> Apply suggestions from code review Co-authored-by: Tim Bannister <[email protected]> Co-authored-by: Daniel Register <[email protected]> Updates based on PR feedback Signed-off-by: Anshuman Tripathi <[email protected]> Update bind-address definition Signed-off-by: Anshuman Tripathi <[email protected]> Update phrasing of permit-address-sharing Signed-off-by: Anshuman Tripathi <[email protected]> Add -- to args Signed-off-by: Anshuman Tripathi <[email protected]> Sentence case in table title Signed-off-by: Anshuman Tripathi <[email protected]> Reword and correct grammer based on feedback Signed-off-by: Anshuman Tripathi <[email protected]> Remove verbatim argument description Signed-off-by: Anshuman Tripathi <[email protected]> More updates Signed-off-by: Anshuman Tripathi <[email protected]> Update custom scheduler heading and description Signed-off-by: Anshuman Tripathi <[email protected]> Remove dashes on args Signed-off-by: Anshuman Tripathi <[email protected]> Apply suggestions from code review Co-authored-by: Tim Bannister <[email protected]> Signed-off-by: Anshuman Tripathi <[email protected]> Update table title Signed-off-by: Anshuman Tripathi <[email protected]> Update based on feedback Signed-off-by: Anshuman Tripathi <[email protected]> node selector Signed-off-by: Anshuman Tripathi <[email protected]> Feedback Signed-off-by: Anshuman Tripathi <[email protected]> Update authentication and TLS configuration Signed-off-by: Anshuman Tripathi <[email protected]> profiling Signed-off-by: Anshuman Tripathi <[email protected]> Replace tables with bullets Signed-off-by: Anshuman Tripathi <[email protected]> Fix custom scheduler directive and link Signed-off-by: Anshuman Tripathi <[email protected]> style Signed-off-by: Anshuman Tripathi <[email protected]>

k8s-ci-robot · 2024-11-11T04:43:13Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign chanieljdan for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

content/en/docs/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Signed-off-by: Anshuman Tripathi <[email protected]>

tabbysable · 2024-12-13T16:31:03Z

content/en/docs/concepts/security/hardening-guide/scheduler.md

+This creates two scheduler profiles: `default-scheduler` and ` my-custom-scheduler`.
+Whenever the `.spec` of a Pod does not have a value for `.spec.schedulerName`, the kube-scheduler runs for that Pod, using its main configuration, and default plugins.
+If you define a Pod with `.spec.schedulerName` set to `my-custom-scheduler`, the kube-scheduler also runs but with a custom configuration; in that custom configuration,
+the  `queueSort`, `filter` and `permit` extension points are disabled.


What in that configuration disables the filter extension point? Is it bundled in somehow with either queueSort or permit?

sftim · 2024-12-13T18:15:12Z

See #45080 (comment) for some relevant commentary about where these docs should live.

k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Feb 10, 2024

k8s-ci-robot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Feb 10, 2024

k8s-ci-robot requested a review from shannonxtreme February 10, 2024 08:07

k8s-ci-robot added the language/en Issues or PRs related to English language label Feb 10, 2024

k8s-ci-robot requested a review from tengqm February 10, 2024 08:07

k8s-ci-robot added the sig/docs Categorizes an issue or PR as relevant to SIG Docs. label Feb 10, 2024

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Feb 10, 2024

k8s-ci-robot added the sig/security Categorizes an issue or PR as relevant to SIG Security. label Feb 10, 2024

AnshumanTripathi marked this pull request as ready for review February 13, 2024 06:34

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Feb 13, 2024

k8s-ci-robot requested a review from dipesh-rawat February 13, 2024 06:34

bijou-code reviewed Feb 13, 2024

View reviewed changes

content/en/docs/concepts/security/hardening-guide/scheduler.md Outdated Show resolved Hide resolved

bijou-code reviewed Feb 13, 2024

View reviewed changes

sftim reviewed Feb 13, 2024

View reviewed changes

raesene reviewed Feb 14, 2024

View reviewed changes

content/en/docs/concepts/security/hardening-guide/scheduler.md Outdated Show resolved Hide resolved

AnshumanTripathi force-pushed the anshuman/scheduler_hardening_guide branch 3 times, most recently from 0728e98 to 2cae0ed Compare February 18, 2024 21:05

AnshumanTripathi commented Feb 18, 2024

View reviewed changes

content/en/docs/concepts/security/hardening-guide/scheduler.md Outdated Show resolved Hide resolved

AnshumanTripathi force-pushed the anshuman/scheduler_hardening_guide branch from 5958b41 to 90fb6d6 Compare February 18, 2024 21:10

sftim reviewed Mar 14, 2024

View reviewed changes

AnshumanTripathi force-pushed the anshuman/scheduler_hardening_guide branch from beca647 to 2aa72f3 Compare March 15, 2024 05:57

AnshumanTripathi force-pushed the anshuman/scheduler_hardening_guide branch from 19972a5 to ab53e96 Compare March 24, 2024 20:13

AnshumanTripathi force-pushed the anshuman/scheduler_hardening_guide branch 3 times, most recently from e3ece46 to b0b839d Compare May 11, 2024 21:30

sftim reviewed May 12, 2024

View reviewed changes

AnshumanTripathi force-pushed the anshuman/scheduler_hardening_guide branch from a56a358 to 898ba26 Compare May 12, 2024 02:26

Huang-Wei reviewed May 16, 2024

View reviewed changes

AnshumanTripathi force-pushed the anshuman/scheduler_hardening_guide branch from 90a0df4 to b702281 Compare June 8, 2024 14:22

raesene reviewed Jun 27, 2024

View reviewed changes

content/en/docs/concepts/security/hardening-guide/scheduler.md Outdated Show resolved Hide resolved

tabbysable reviewed Jun 27, 2024

View reviewed changes

content/en/docs/concepts/security/hardening-guide/scheduler.md Outdated Show resolved Hide resolved

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jun 27, 2024

AnshumanTripathi force-pushed the anshuman/scheduler_hardening_guide branch 2 times, most recently from 48f872a to aff9201 Compare July 21, 2024 07:28

tengqm reviewed Sep 10, 2024

View reviewed changes

content/en/docs/concepts/security/hardening-guide/scheduler.md Show resolved Hide resolved

tengqm reviewed Sep 10, 2024

View reviewed changes

AnshumanTripathi mentioned this pull request Sep 15, 2024

REQUEST: New membership for AnshumanTripathi kubernetes/org#5160

Closed

11 tasks

AnshumanTripathi force-pushed the anshuman/scheduler_hardening_guide branch from a3bc006 to 3006e43 Compare September 21, 2024 20:47

This was referenced Sep 21, 2024

Kubernetes Hardening Guide kubernetes/sig-security#30

Open

Move Hardening guides out of concepts section #48069

Open

AnshumanTripathi force-pushed the anshuman/scheduler_hardening_guide branch from 82c18fd to 645c130 Compare September 29, 2024 21:26

network-charles reviewed Oct 4, 2024

View reviewed changes

content/en/docs/concepts/security/hardening-guide/scheduler.md Outdated Show resolved Hide resolved

AnshumanTripathi force-pushed the anshuman/scheduler_hardening_guide branch 2 times, most recently from 3257350 to 0f58ec4 Compare October 6, 2024 04:40

tabbysable reviewed Oct 21, 2024

View reviewed changes

content/en/docs/concepts/security/hardening-guide/scheduler.md Outdated Show resolved Hide resolved

AnshumanTripathi force-pushed the anshuman/scheduler_hardening_guide branch from 0f58ec4 to 0b307ff Compare November 11, 2024 04:42

Update based on feedback

dda9966

Signed-off-by: Anshuman Tripathi <[email protected]>

tabbysable reviewed Dec 13, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Security hardening guide for scheduler configuration #45080

Security hardening guide for scheduler configuration #45080

AnshumanTripathi commented Feb 10, 2024 •

edited

Loading

linux-foundation-easycla bot commented Feb 10, 2024 •

edited

Loading

k8s-ci-robot commented Feb 10, 2024

netlify bot commented Feb 10, 2024 •

edited

Loading

sftim commented Feb 10, 2024

reylejano commented Feb 13, 2024

sftim left a comment

sftim commented May 12, 2024

sftim left a comment

k8s-ci-robot commented Nov 11, 2024

tabbysable Dec 13, 2024

sftim commented Dec 13, 2024

Security hardening guide for scheduler configuration #45080

Are you sure you want to change the base?

Security hardening guide for scheduler configuration #45080

Conversation

AnshumanTripathi commented Feb 10, 2024 • edited Loading

linux-foundation-easycla bot commented Feb 10, 2024 • edited Loading

k8s-ci-robot commented Feb 10, 2024

netlify bot commented Feb 10, 2024 • edited Loading

✅ Pull request preview available for checking

sftim commented Feb 10, 2024

reylejano commented Feb 13, 2024

sftim left a comment

Choose a reason for hiding this comment

sftim commented May 12, 2024

sftim left a comment

Choose a reason for hiding this comment

k8s-ci-robot commented Nov 11, 2024

tabbysable Dec 13, 2024

Choose a reason for hiding this comment

sftim commented Dec 13, 2024

AnshumanTripathi commented Feb 10, 2024 •

edited

Loading

linux-foundation-easycla bot commented Feb 10, 2024 •

edited

Loading

netlify bot commented Feb 10, 2024 •

edited

Loading