Lightning Talk: Secure Multi User HPC Jobs in Kubernetes with Kyverno
summary
Ohio Supercomputer Center uses Open OnDemand + Kubernetes and Kyverno to run interactive HPC apps (RStudio, Jupyter) for classrooms, enforcing user file access by mapping LDAP uid/gid into policies via kldap config map so pods run as the correct UID/GID and supplemental groups. Policies restrict hostPath mounts, disallow privilege escalation, cap resources and runtime, and rely on validate on create and update because LDAP changes can block deletes. Deployment is live for multi‑user classes.
AI-written summary · about
chapters (10)
- 0:00Intro
- 0:28Technologies
- 1:05Challenges
- 1:45Design Patterns
- 2:32Policy Solutions
- 3:03Max Resource Requests
- 3:29LDAP Data
- 3:56Validate Supplemental Groups
- 4:12Additional Policies
- 4:39Resources
related talks
06mProject Lightning Talk: Kyverno: Kubernetes Policy as Code Unleashed!
12mLightning Talk: {”spec”: “nodeSelector”: "EuroHPC"}
23mImplementation Challenges: From HPC to Containers in the Academy
08mLightning Talk: Orchestrating Kubernetes Clusters on HPC Infrastructure
29mUnlocking Kyverno: Mastering Policy Management in Large-Scale Kubernetes Clusters
16mSecuring the Edge: Multi-Cluster Governance With Kyverno on K0rdent’s Fleets
05mLightning Talk: What Makes a Good Multi-tenant Kubernetes Solution?
06mProject Lightning Talk: The Kyverno Five! Policy Types for the Full Resource Lifecycle