Review Privileged Pods and add more content

[lixuna]

Goal: Review Privileged Pods and add more content

Tasks:

• Review Privileged Pods
• Create copy of slides
• add more content
• Create an outline
• Create a rough draft
• Peer review of draft
• Iterate as needed, peer review (optional)
• Add content to https://docs.google.com/presentation/d/1K81kQgqs3HMp-P1TVoeI6D2kIz7Qbz9JjTFohfTb9yA/edit#slide=id.g7d9866f192_0_0

ref: s32

[lixuna]

Reference links:

https://kubernetes.io/docs/concepts/workloads/pods/pod/#privileged-mode-for-pod-containers

https://www.cncf.io/blog/2019/04/29/what-kubernetes-does-and-doesnt-do-for-security/

[denverwilliams]

Seems like the second point might have more clarity if it directly references the forementioned tools.

[Original]
We’re investigating having a selection of open source CNFs for this initial configuration – which would run in privileged mode – which could then be required by other CNFs needing this functionality

[Update]
We’re investigating using a selection of the above tools for this initial configuration – which would run in privileged mode – which could then be required by other CNFs needing this functionality

[michaelspedersen]

I'm not sure if having a separate slide discussing "privileged" is a good idea. To some extend this topic is already covered in both the "security" and the "HW and affinity" sections.

Privileged mode is mainly used to utilize specific parts of the host SW (e.g. kernel, network) or hardware (e.g. CPU, memory, PCI), and these resources should be available through CNIs, device plugins etc.