Kubernetes - Pod Security Policies

Tue, 19 Nov 2019 15:05:04 +0000

Securing and hardening our Kubernetes clusters is a must do activity. We need to remember that containers are still just processes running on the host machines. Sometimes these processes can get more privileges on the Kubernetes node than they should, if you don’t properly setup some pod security. This post explains how this could be done for your own clusters.

Pod Security Policies - The Theory

Pod Security policies are designed to limit what can be run on a Kubernetes cluster. Typical things that you might want to limit are: pods that have privileged access, pods with access to the host network, and pods that have access to the host processes just to name a few. Remember that a container isn’t as isolated as a VM so we should take care to ensure our containers aren’t adversely affecting our nodes’s health and security.

Path Selection Policy with ALUA

Thu, 08 Mar 2012 13:58:05 +0000

It’s important to understand how VMware ESXi servers handle connections to their associated storage arrays.

If we look specifically with fibre channel fabrics, we have several multipathing options to be considered. There are three path selection policy (PSP) plugins that VMware uses natively to determine the I/O channel that data will travel over to the storage device.

Fixed Path
Most Recently Used (MRU)
Round Robin (RR)

Let’s look at some examples of the three PSPs we’ve mentioned and how they behave. The definitions come from the vSphere 5 storage guide found below.

Psp on The IT Hollow

Kubernetes - Pod Security Policies

Pod Security Policies - The Theory

Path Selection Policy with ALUA