Production-Grade Container Scheduling and Management
Go to file
Patrick Ohly 1fde2b884c DRA node: reject static pods which reference ResourceClaims
If someone gains the ability to create static pods, they might try to use that
ability to run code which gets access to the resources associated with some
existing claim which was previously allocated for some other pod. Such an
attempt already fails because the claim status tracks which pods are allowed to
use the claim, the static pod is not in that list, the node is not authorized
to add it, and the kubelet checks that list before starting the pod in
195803cde5/pkg/kubelet/cm/dra/manager.go (L218-L222).

Even if the pod were started, DRA drivers typically manage node-local resources
which can already be accessed via such an attack without involving DRA. DRA
drivers which manage non-node-local resources have to consider access by a
compromised node as part of their threat model.

Nonetheless, it is better to not accept static pods which reference
ResourceClaims or ResourceClaimTemplates in the first place because there
is no valid use case for it.

This is done at different levels for defense in depth:
- configuration validation in the kubelet
- admission checking of node restrictions
- API validation

Co-authored-by: Jordan Liggitt <liggitt@google.com>

Code changes by Jordan, with one small change (resourceClaims -> resourceclaims).
Unit tests by Patrick.
2025-05-21 08:40:50 +02:00
.github
api rename DeploymentPodReplacementPolicy FG to DeploymentReplicaSetTerminatingReplicas 2025-03-27 20:27:44 +01:00
build [Go] Bump dependencies, images and versions used to Go 1.24.2 and distroless-iptables 2025-04-18 15:49:48 +02:00
CHANGELOG Update CHANGELOG/CHANGELOG-1.33.md for v1.33.1 2025-05-15 08:46:51 +00:00
cluster Merge pull request #131146 from mauriciopoppe/csi-proxy-1-2-1 2025-04-08 02:06:44 -07:00
cmd Stop exposing list-via-watch from the server 2025-04-18 09:21:23 -04:00
docs
hack Update etcd to 3.5.21 2025-04-02 02:16:38 +08:00
LICENSES Vendor randfill 2025-03-08 15:21:58 -08:00
logo
pkg DRA node: reject static pods which reference ResourceClaims 2025-05-21 08:40:50 +02:00
plugin DRA node: reject static pods which reference ResourceClaims 2025-05-21 08:40:50 +02:00
staging Automated cherry pick of #130503: Unhandled panic crash on rollout_history printer.PrintObj (#131496) 2025-05-14 00:26:54 -07:00
test Merge pull request #131369 from ameukam/update-1242-master 2025-04-21 09:19:06 -07:00
third_party Revert "tests: include stdout of failed commands in JUnit" 2025-01-22 23:36:50 +01:00
vendor Move to released version of prometheus/client_golang v1.22.0 from rc.0 2025-04-08 08:35:18 -04:00
.generated_files
.gitattributes
.gitignore
.go-version [Go] Bump dependencies, images and versions used to Go 1.24.2 and distroless-iptables 2025-04-18 15:49:48 +02:00
CHANGELOG.md
code-of-conduct.md
CONTRIBUTING.md
go.mod Move to released version of prometheus/client_golang v1.22.0 from rc.0 2025-04-08 08:35:18 -04:00
go.sum Move to released version of prometheus/client_golang v1.22.0 from rc.0 2025-04-08 08:35:18 -04:00
go.work bump go.mod to set min go1.24 2025-02-26 11:27:07 +01:00
go.work.sum Vendor randfill 2025-03-08 15:21:58 -08:00
LICENSE
Makefile
OWNERS
OWNERS_ALIASES update sig cl owners in k/k 2025-02-12 11:04:11 +02:00
README.md Fix Borg pub link in README 2024-12-23 00:15:17 +03:30
SECURITY_CONTACTS
SUPPORT.md

Kubernetes (K8s)

CII Best Practices Go Report Card GitHub release (latest SemVer)


Kubernetes, also known as K8s, is an open source system for managing containerized applications across multiple hosts. It provides basic mechanisms for the deployment, maintenance, and scaling of applications.

Kubernetes builds upon a decade and a half of experience at Google running production workloads at scale using a system called Borg, combined with best-of-breed ideas and practices from the community.

Kubernetes is hosted by the Cloud Native Computing Foundation (CNCF). If your company wants to help shape the evolution of technologies that are container-packaged, dynamically scheduled, and microservices-oriented, consider joining the CNCF. For details about who's involved and how Kubernetes plays a role, read the CNCF announcement.


To start using K8s

See our documentation on kubernetes.io.

Take a free course on Scalable Microservices with Kubernetes.

To use Kubernetes code as a library in other applications, see the list of published components. Use of the k8s.io/kubernetes module or k8s.io/kubernetes/... packages as libraries is not supported.

To start developing K8s

The community repository hosts all information about building Kubernetes from source, how to contribute code and documentation, who to contact about what, etc.

If you want to build Kubernetes right away there are two options:

You have a working Go environment.
git clone https://github.com/kubernetes/kubernetes
cd kubernetes
make
You have a working Docker environment.
git clone https://github.com/kubernetes/kubernetes
cd kubernetes
make quick-release

For the full story, head over to the developer's documentation.

Support

If you need support, start with the troubleshooting guide, and work your way through the process that we've outlined.

That said, if you have questions, reach out to us one way or another.

Community Meetings

The Calendar has the list of all the meetings in the Kubernetes community in a single location.

Adopters

The User Case Studies website has real-world use cases of organizations across industries that are deploying/migrating to Kubernetes.

Governance

Kubernetes project is governed by a framework of principles, values, policies and processes to help our community and constituents towards our shared goals.

The Kubernetes Community is the launching point for learning about how we organize ourselves.

The Kubernetes Steering community repo is used by the Kubernetes Steering Committee, which oversees governance of the Kubernetes project.

Roadmap

The Kubernetes Enhancements repo provides information about Kubernetes releases, as well as feature tracking and backlogs.