Don’t Trust Your Neighbors: Securing Pods via Scheduling
summary
Proposal introduces SySched a Kubernetes scheduling plugin that co-locates pods based on system call exposure risk using XS extraneous syscalls score computed per pod per feasible node and optional risk weights per syscall It integrates with the Security Profile Operator to collect eBPF or audit based syscall profiles and ranks nodes to minimize XS The evaluation on 42 apps shows blast radius reductions up to 48 percent fewer victim pods and up to 46 percent fewer affected nodes compared to the default scheduler
AI-written summary · about
chapters (12)
- 0:00Start
- 0:29Anatomy of Typical Pod Deployment
- 3:40Scheduling can Reduce the Impact of Bad Neighbors!
- 5:35How SySched Works
- 7:41Why Pod Placement Could Improve Security
- 10:33SySched: Scheduling Illustration
- 12:30System call Weights and Pod Placement
- 14:47Threat model: What SySched Does and Does NOT Do
- 17:40SySched: Design Overview
- 19:16Challenge: How to Obtain Pod's Syscalls
- 39:47Security and Performance Evaluation
- 44:16Current Status
related talks
30mPod Security as an Afterthought
30mEnhancing the Kubernetes Scheduler for Diverse Workloads in Large Clusters
09mLightning Talk: Securing K8s Pods from Within: A Runtime Approach
23mOptimizing Storage Assignment via Pod Scheduling Under Disturbance Factors
40mKubernetes Security After Pod Security Policies Removal
30mDeep Dive: Scheduling SIG
31mSafeguarding Kubernetes: Pod Security Admission, NeuVector & Kyverno in the Ring
33mBringing Pod Security Admission to Your Kubernetes Distribution