Security hardening guide for scheduler configuration #45080

AnshumanTripathi · 2024-02-10T08:07:00Z

Creating a scheduler hardening guide as a part of kubernetes/sig-security#30.

Page preview - https://deploy-preview-45080--kubernetes-io-main-staging.netlify.app/docs/concepts/security/hardening-guide/scheduler/

linux-foundation-easycla · 2024-02-10T08:07:06Z

The committers listed above are authorized under a signed CLA.

✅ login: AnshumanTripathi / name: Anshuman Tripathi (b0d8a8c)

k8s-ci-robot · 2024-02-10T08:07:08Z

Welcome @AnshumanTripathi!

It looks like this is your first PR to kubernetes/website 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/website has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

netlify · 2024-02-10T08:09:24Z

✅ Pull request preview available for checking

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`b0d8a8c`
🔍 Latest deploy log	https://app.netlify.com/projects/kubernetes-io-main-staging/deploys/683b8316a957710008f5458d
😎 Deploy Preview	https://deploy-preview-45080--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

sftim · 2024-02-10T17:51:55Z

/sig security

content/en/docs/concepts/security/hardening-guide/scheduler.md

reylejano · 2024-02-13T19:11:21Z

@kubernetes/sig-security-pr-reviews please take a look

content/en/docs/concepts/security/hardening-guide/scheduler.md

sftim

Some more feedback.

content/en/docs/concepts/security/hardening-guide/scheduler.md

t-inu · 2025-03-11T16:29:03Z

/remove-area localization
/remove-language ja

mtardy · 2025-05-26T09:57:57Z

Please wrap these long lines as you did for some other paragraphs.

As mentioned, could you wrap all your lines so that's it's easier to make suggestions and edits?

AnshumanTripathi · 2025-05-27T03:30:39Z

Please wrap these long lines as you did for some other paragraphs.

As mentioned, could you wrap all your lines so that's it's easier to make suggestions and edits?

Wrapped long lines. LMK more is needed.

Signed-off-by: Anshuman Tripathi <anshuman.tripathi305@gmail.com> [WIP] Security hardening guide for scheduler configurations Signed-off-by: Anshuman Tripathi <anshuman.tripathi305@gmail.com> Updates after passing through hemmingway.app Signed-off-by: Anshuman Tripathi <anshuman.tripathi305@gmail.com> Update scheduling configurations Signed-off-by: Anshuman Tripathi <anshuman.tripathi305@gmail.com> Apply suggestions from code review Co-authored-by: Tim Bannister <tim@scalefactory.com> Co-authored-by: Daniel Register <jedion9@yahoo.com> Updates based on PR feedback Signed-off-by: Anshuman Tripathi <anshuman.tripathi305@gmail.com> Update bind-address definition Signed-off-by: Anshuman Tripathi <anshuman.tripathi305@gmail.com> Update phrasing of permit-address-sharing Signed-off-by: Anshuman Tripathi <anshuman.tripathi305@gmail.com> Add -- to args Signed-off-by: Anshuman Tripathi <anshuman.tripathi305@gmail.com> Sentence case in table title Signed-off-by: Anshuman Tripathi <anshuman.tripathi305@gmail.com> Reword and correct grammer based on feedback Signed-off-by: Anshuman Tripathi <anshuman.tripathi305@gmail.com> Remove verbatim argument description Signed-off-by: Anshuman Tripathi <anshuman.tripathi305@gmail.com> More updates Signed-off-by: Anshuman Tripathi <anshuman.tripathi305@gmail.com> Update custom scheduler heading and description Signed-off-by: Anshuman Tripathi <anshuman.tripathi305@gmail.com> Remove dashes on args Signed-off-by: Anshuman Tripathi <anshuman.tripathi305@gmail.com> Apply suggestions from code review Co-authored-by: Tim Bannister <tim@scalefactory.com> Signed-off-by: Anshuman Tripathi <anshuman.tripathi305@gmail.com> Update table title Signed-off-by: Anshuman Tripathi <anshuman.tripathi305@gmail.com> Update based on feedback Signed-off-by: Anshuman Tripathi <anshuman.tripathi305@gmail.com> node selector Signed-off-by: Anshuman Tripathi <anshuman.tripathi305@gmail.com> Feedback Signed-off-by: Anshuman Tripathi <anshuman.tripathi305@gmail.com> Update authentication and TLS configuration Signed-off-by: Anshuman Tripathi <anshuman.tripathi305@gmail.com> profiling Signed-off-by: Anshuman Tripathi <anshuman.tripathi305@gmail.com> Replace tables with bullets Signed-off-by: Anshuman Tripathi <anshuman.tripathi305@gmail.com> Fix custom scheduler directive and link Signed-off-by: Anshuman Tripathi <anshuman.tripathi305@gmail.com> style Signed-off-by: Anshuman Tripathi <anshuman.tripathi305@gmail.com> Update based on feedback Signed-off-by: Anshuman Tripathi <anshuman.tripathi305@gmail.com> fix: custom scheduler profile Signed-off-by: Anshuman Tripathi <anshuman.tripathi305@gmail.com>

raesene · 2025-06-05T06:17:05Z

/lgtm

k8s-ci-robot · 2025-06-05T06:17:12Z

LGTM label has been added.

Git tree hash: 7450a0d530136c46aa8f2457c3b8c6e514ed1ffe

lmktfy · 2025-06-05T07:39:56Z

/approve

Happy to see the content reorganized where needed, along with existing content.

k8s-ci-robot · 2025-06-05T07:40:06Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: lmktfy

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~content/en/docs/OWNERS~~ [lmktfy]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

natalisucks · 2025-06-05T11:36:21Z

hey folks – i'm seeing a hold on this PR but it's not clear why its the case. are we ready to unhold and merge? we have several reviews from Security and Docs – thanks for clarifying! @tabbysable @raesene @lmktfy

lmktfy · 2025-06-05T11:42:17Z

If we really need to revert, we can.
I think the concern was from resolved comments - #45080 (comment)

/hold cancel

k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Feb 10, 2024

k8s-ci-robot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Feb 10, 2024

k8s-ci-robot requested a review from shannonxtreme February 10, 2024 08:07

k8s-ci-robot added the language/en Issues or PRs related to English language label Feb 10, 2024

k8s-ci-robot requested a review from tengqm February 10, 2024 08:07

k8s-ci-robot added the sig/docs Categorizes an issue or PR as relevant to SIG Docs. label Feb 10, 2024

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Feb 10, 2024

k8s-ci-robot added the sig/security Categorizes an issue or PR as relevant to SIG Security. label Feb 10, 2024

AnshumanTripathi marked this pull request as ready for review February 13, 2024 06:34

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Feb 13, 2024

k8s-ci-robot requested a review from dipesh-rawat February 13, 2024 06:34

bijou-code reviewed Feb 13, 2024

View reviewed changes

content/en/docs/concepts/security/hardening-guide/scheduler.md Outdated Show resolved Hide resolved

bijou-code reviewed Feb 13, 2024

View reviewed changes

sftim reviewed Feb 13, 2024

View reviewed changes

raesene reviewed Feb 14, 2024

View reviewed changes

content/en/docs/concepts/security/hardening-guide/scheduler.md Outdated Show resolved Hide resolved

AnshumanTripathi force-pushed the anshuman/scheduler_hardening_guide branch 3 times, most recently from 0728e98 to 2cae0ed Compare February 18, 2024 21:05

AnshumanTripathi commented Feb 18, 2024

View reviewed changes

content/en/docs/concepts/security/hardening-guide/scheduler.md Outdated Show resolved Hide resolved

AnshumanTripathi force-pushed the anshuman/scheduler_hardening_guide branch from 5958b41 to 90fb6d6 Compare February 18, 2024 21:10

sftim reviewed Mar 14, 2024

View reviewed changes

AnshumanTripathi force-pushed the anshuman/scheduler_hardening_guide branch from beca647 to 2aa72f3 Compare March 15, 2024 05:57

AnshumanTripathi force-pushed the anshuman/scheduler_hardening_guide branch from 19972a5 to ab53e96 Compare March 24, 2024 20:13

AnshumanTripathi force-pushed the anshuman/scheduler_hardening_guide branch from 37e8ff3 to 767eb20 Compare March 7, 2025 16:12

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Mar 7, 2025

AnshumanTripathi force-pushed the anshuman/scheduler_hardening_guide branch from 767eb20 to c1a7095 Compare March 8, 2025 03:29

k8s-ci-robot removed area/localization General issues or PRs related to localization language/ja Issues or PRs related to Japanese language labels Mar 11, 2025

AnshumanTripathi force-pushed the anshuman/scheduler_hardening_guide branch from c1a7095 to 54dcea7 Compare May 26, 2025 02:34

AnshumanTripathi force-pushed the anshuman/scheduler_hardening_guide branch 2 times, most recently from 5d7b524 to 3c15880 Compare May 27, 2025 03:29

AnshumanTripathi force-pushed the anshuman/scheduler_hardening_guide branch from 3c15880 to b0d8a8c Compare May 31, 2025 22:30

k8s-ci-robot assigned raesene Jun 5, 2025

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 5, 2025

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 5, 2025

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jun 5, 2025

k8s-ci-robot merged commit 8992fe7 into kubernetes:main Jun 5, 2025
6 checks passed

AnshumanTripathi deleted the anshuman/scheduler_hardening_guide branch June 15, 2025 07:18

Security hardening guide for scheduler configuration #45080

Security hardening guide for scheduler configuration #45080

Uh oh!

Conversation

AnshumanTripathi commented Feb 10, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

linux-foundation-easycla bot commented Feb 10, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented Feb 10, 2024

Uh oh!

netlify bot commented Feb 10, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Pull request preview available for checking

Uh oh!

sftim commented Feb 10, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

reylejano commented Feb 13, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sftim left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

t-inu commented Mar 11, 2025

Uh oh!

mtardy commented May 26, 2025

Uh oh!

AnshumanTripathi commented May 27, 2025

Uh oh!

raesene commented Jun 5, 2025

Uh oh!

k8s-ci-robot commented Jun 5, 2025

Uh oh!

lmktfy commented Jun 5, 2025

Uh oh!

k8s-ci-robot commented Jun 5, 2025

Uh oh!

natalisucks commented Jun 5, 2025

Uh oh!

lmktfy commented Jun 5, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

14 participants

AnshumanTripathi commented Feb 10, 2024 •

edited

Loading

linux-foundation-easycla bot commented Feb 10, 2024 •

edited

Loading

netlify bot commented Feb 10, 2024 •

edited

Loading