awslabs / aws-virtual-kubelet Goto Github PK
View Code? Open in Web Editor NEWLicense: Apache License 2.0
License: Apache License 2.0
Today, when calling RunInstance API, virtual Kubelet fetches the parameters from PodSpec and pass that value to EC2. VK should support fetching these from ConfigMap also. This will allow ClusterAdministrator to control what parameters to use and also improves the UX for application developers.
Permissions defined in https://github.com/awslabs/aws-virtual-kubelet/blob/main/deploy/vk-clusterrole_binding.yaml are most likely wider-scoped than necessary.
Reduce to the minimal set of permissions needed for the system to run code that is in main
today. e.g. remove these unless the system cannot run without them:
- apiGroups: [""]
resources: ["configmaps", "secrets"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["pods", "pods/status"]
verbs: ["update", "delete", "create"]
Run with wide permission scope. Not desirable from a security perspective.
https://github.com/awslabs/aws-virtual-kubelet/blob/main/internal/ec2provider/ec2provider.go#L216 should not return an error, but instead should continue with pod deletion.
Since we are about to terminate the EC2 instance anyway, we should just log a warning and proceed.
We could attempt a graceful shutdown initially with a (context-based) timeout that proceeds with forceful shutdown after a period of time. Currently no use-cases exist that require this level of "gentle" handling at the application level though.
We need to understand why each permission is needed for aws-virtual-kubelet and what operation(s) the permission setting enables. Also document what exactly fails in aws-virtual-kubelet when the permission is removed. See example below.
A comment similar to the following should be added for each permission:
# When our custom provider returns an error, the upstream virtual-kubelet library uses a k8s client to update Pod status
# directly. e.g.
# https://github.com/virtual-kubelet/virtual-kubelet/blob/bf3a764409b5fa5ae8f613797e4c648e9c38c4eb/node/pod.go#L172
# This requires the `pod:update` permission in the service account role.
#
# When this permission is _not_ present, virtual-kubelet is unable to update k8s with
# pod status changes which causes k8s to become out-of-sync with the pod state vs. virtual-kubelet.
Try to identify at least one use-case from the upstream virtual-kubelet library (or our custom provider) for each permission.
NOTE
that a permission is a combination of a resource and a verb (e.g. get pod). You may need to separate rules into smaller groups to facilitate documentation where a large number of verbs are allowed for multiple resources.
PR #11 attempted to complete this exercise but did not have the full set of requirements.
Instructions for building and using the provided example agent are missing/incomplete.
There is a provision in the code to enable retrieval of the agent software via user data (e.g. from S3). This use-case should be enable-able via configuration and documented.
https://github.com/awslabs/aws-virtual-kubelet/blob/main/internal/vkvmaclient/vkvmaclient.go#L144
I expect the provider to not exit when emitting a status log line (https://pkg.go.dev/log#Fatalf invokes os.Exit(1)
)
Introduce a >1s delay in the VKVMAgent dial connection.
aws-virtual-kubelet
v0.5.2
GitHub actions running from public forks only have read access. A step in the Format
workflow updated the PR status with failed files for easier resolution (vs. having to look at the workflow run log to find the failed files). This fails when ran from a public fork with Resource not accessible by integration
.
PR Workflows should run correctly from both forks and branches in this repo.
Create a PR from a fork, observe errors in the Format
workflow's logs (other workflow jobs also fail for the same root reason).
https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ proposes a solution with 2 workflows. One to read / generate information from the user's PR code and generate a build artifact with the data. Another that triggers off this one via the workflow_run
event, which grants a write-capable token. This second workflow is where examination of the previous one's artifact data and the POSTing of statuses, comments, etc. to the PR happens. The second workflow doesn't build or run the user's code which sharply increases security.
No documentation exists for the release process.
The release process should be documented and/or automated.
The current flow / steps are:
main
using common prefixes like fix
, feat
, etc. to organize branches by type-rc.1
, -rc.2
etc. qualifiers for pre-releases
main
is tagged with the appropriate version identifier)In addition to the existing Unit Tests, there should be a suite of Integration or Runtime tests that verify behavior of the system while running. This is likely an implementation of the upstream virtual-kubelet
library's importable e2e test framework.
No runtime tests is an option (and the current state). This leads to an increase in failures released to "production" though.
There are some specific use-cases already identified for these tests to cover. GitHub Actions integration for automated test runs is desirable, but having a way to run locally is sufficient.
Documentation to see VK metrics via Prometheus or other mechanism is missing.
Some steps exist telling users how to view the metrics.
Metrics are there and viewable on individual nodes via the prometheus endpoint.
I'm familiar with virtual kubelet as a technique for scheduling FAAS in a k8s cluster.
Is that a potential use for this virtual kubelet?
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.