Patrick Ohly 9a67ee4a70 DRA node: reject static pods which reference ResourceClaims ... If someone gains the ability to create static pods, they might try to use that ability to run code which gets access to the resources associated with some existing claim which was previously allocated for some other pod. Such an attempt already fails because the claim status tracks which pods are allowed to use the claim, the static pod is not in that list, the node is not authorized to add it, and the kubelet checks that list before starting the pod in 195803cde5/pkg/kubelet/cm/dra/manager.go (L218-L222). Even if the pod were started, DRA drivers typically manage node-local resources which can already be accessed via such an attack without involving DRA. DRA drivers which manage non-node-local resources have to consider access by a compromised node as part of their threat model. Nonetheless, it is better to not accept static pods which reference ResourceClaims or ResourceClaimTemplates in the first place because there is no valid use case for it. This is done at different levels for defense in depth: - configuration validation in the kubelet - admission checking of node restrictions - API validation Co-authored-by: Jordan Liggitt <liggitt@google.com> Code changes by Jordan, with one small change (resourceClaims -> resourceclaims). Unit tests by Patrick.		2025-05-21 08:40:28 +02:00
..
admission	DRA node: reject static pods which reference ResourceClaims	2025-05-21 08:40:28 +02:00
auth	Add Additional Tests	2025-02-27 10:53:15 +09:00