[YUNIKORN-1306] [Umbrella] Enhanced user and group handling

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.2.0
• Component/s: shim - kubernetes
• Labels: release-notes
• Target Version: 1.2.0
• Assignee: Peter Bacsko
• Reporter: Peter Bacsko
• Created: 06/Sep/22 11:22
• Updated: 07/Feb/23 22:33
• Resolved: 30/Nov/22 14:43

Description

Yunikorn needs a more secure and robust user/group handling.

Currently, the YK handles users is by using a label on the pod. However, this label can contain anything and no verification is performed by Yunikorn to make sure that the users are what the label say they are. If the label is missing, the submitter is considered to be a "default" user.

The group support is also lacking. There is a lookup feature in the core, but that is very limited. It's an OS-based lookup similar to how Hadoop works, but YK runs inside a container. Determining which group a user belongs to is too late in the core.

Yunikorn needs to be able to lookup/detect the real user and group of the workload (be it a pod or a deployment, job, etc) plus provide backward compatibility because there are already solutions built on the existing label.

Issue Links

• is related to: YUNIKORN-984 [Umbrella] User quota tracking

Sub-Tasks

• Create design document: Closed
• [admission] add new config value handling and allow/deny label if defined: Closed
• [shim] pass group info from the shim to the core: Closed
• [admission] support different kind of workloads other than pods: Closed
• [admission] look up user & group and add annotation if necessary: Closed
• [release] update values and deployment helm chart of the admission controller: Closed
• [shim] Add e2e tests for group handling: Closed
• [shim] Handle new userInfo annotation: Closed
• [shim] use the parent's user-group info if the pod has an ownerReference defined: Closed
• [site] Update documentation about user/group resolution: Closed
• Update user/group regex values in the defaults & test code: Closed
• User/group resolution: update documentation about configmaps: Closed