1. Setting policies in kubernetes

2. Can we use the same environment?
2 goals
Sandboxed computing environment to scientists
Access to it’s underlying infrastructure to network engineers and sysadmins
Can we use the same environment?
Don’t care where exactly code runs
Care about computing resources they get/can use
Want to collaborate or protect their data
Need to execute code on particular hardware
No high resources demand
Have highest access level to the data and infrastructure, need to define privileges

3. Resources management Scientists don’t care where code runs
Network Engineers need to
Execute code on particular hardware

4. Infrastructure changes
Hardware appears, disappears, breaks, moves around
Automatically reschedule user jobs
Respecting the policies
Not annoying scientists with those changes
Reconfigure monitoring

5. Containers: Contain only the code to run
Don't depend on the environment – docker provides unified one
Can request needed resources from the host (if allowed)
Stateless – easy to reschedule
Store state in persistent storage, which isn’t tied to a host

6. Namespaces Isolate user space Create environment to collaborate
Define policies

7. Node labels We define the labeling scheme
Users request/limit needed resources (CPU, MEM, GPU, …) by using labels

8. Pod security policies Define level of isolation from the host
Can bind to host network?
Host capabilities?
Privileges escalation?
What can mount?
controls the level of isolation from host
Can we bind to host network?
What can we do on the host?
Control OS settings?
Isolate scientists but provide access to network engineers and tooling
PODs can only do what the user running it can do - no privileges escalation (unless allowed)

9. Role-Based Access Control (RBAC)
root admin
Can do anything (assign admins, manage system resources, deploy monitoring and tuning tools, set/unset restrictions on nodes based on namespace)
Have access to full kubernetes API - flexibility, rich capabilities
admin
Can create and delete namespaces, add/delete users and admins to namespaces under control
Do it with web portal - easy, no entry barrier.
user
Can run computations in namespaces created and controlled by an admin
Might have access to several namespaces
guest
Can’t run or view anything
Can be promoted to user or admin