Page MenuHomePhabricator

Add security sensitive nodes to our kubernetes cluster
Closed, ResolvedPublic

Description

We would like to schedule the kask session storage service on their dedicated hosts in our kubernetes cluster in order to avoid interactions with the other services. This should mitigate the case of another service being exploited on the kubernetes nodes and being able to jump to the session storage service and obtain security sensitive information.

The proposed approach has been to create a couple of VMs on our ganeti infrastructure (1 per rack row) with the required resources and instruct kask to be instantiated only there.

Details

Related Gerrit Patches:
operations/puppet : productionAdd a dedicated=kask label to kask nodes
operations/puppet : productionKubernetes node labels followup
operations/puppet : productionSupport node labels and taints in kubelet

Event Timeline

akosiaris triaged this task as Normal priority.Apr 12 2019, 1:36 PM

Change 504849 had a related patch set uploaded (by Alexandros Kosiaris; owner: Alexandros Kosiaris):
[operations/puppet@production] Support node labels and taints in kubelet

https://gerrit.wikimedia.org/r/504849

Change 504849 merged by Alexandros Kosiaris:
[operations/puppet@production] Support node labels and taints in kubelet

https://gerrit.wikimedia.org/r/504849

Change 504897 had a related patch set uploaded (by Alexandros Kosiaris; owner: Alexandros Kosiaris):
[operations/puppet@production] Kubernetes node labels followup

https://gerrit.wikimedia.org/r/504897

Change 504897 merged by Alexandros Kosiaris:
[operations/puppet@production] Kubernetes node labels followup

https://gerrit.wikimedia.org/r/504897

akosiaris closed this task as Resolved.Apr 22 2019, 6:41 PM

kubernetes1005, kubernetes1006, kubernetes2005, kubernetes2006 added with specific taints in order to have only kask being scheduled on them. Resolving

Change 505832 had a related patch set uploaded (by Alexandros Kosiaris; owner: Alexandros Kosiaris):
[operations/puppet@production] Add a dedicated=kask label to kask nodes

https://gerrit.wikimedia.org/r/505832

Change 505832 merged by Alexandros Kosiaris:
[operations/puppet@production] Add a dedicated=kask label to kask nodes

https://gerrit.wikimedia.org/r/505832