high-privilege service account in Driver Pods cause attack

[tingweiwu]

About the Service Account for Driver Pods

Use the service account in driver pod, you can create pod with any spec.

If PodSecurityPolicy or PodSecurityAdmission is not restricted, attacker can directly create a permission container mount machine shares the host namespace and directly obtains the computing node control permission. Even though PodSecurityPolicy or PodSecurityAdmission is restricted, may cause number of unrelated pods created

is there any suggestions for security protection?

is there a way to restrict the creation of pods by user code, or restrict executor pod spec which craete by driver pod

[0marq]

+1

[github-actions[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.