Skip to content
This repository has been archived by the owner on Jan 29, 2025. It is now read-only.

Commit

Permalink
Fix high-level trivy findings
Browse files Browse the repository at this point in the history 
This fixes the high-level trivy findings, and many of the mediums
and the lows.

Signed-off-by: Ukri Niemimuukko <[email protected]>
  • Loading branch information
@uniemimu
uniemimu committed Feb 26, 2024
1 parent 0bc3ab2 commit e02f456
Show file tree
Hide file tree
Showing 8 changed files with 140 additions and 1 deletion.
2 changes: 1 addition & 1 deletion gpu-aware-scheduling/.golangci.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ linters-settings:
gofmt:
simplify: true
gofumpt:
lang-version: "1.19"
lang-version: "1.21"
golint:
min-confidence: 0.9
govet:
Expand Down
4 changes: 4 additions & 0 deletions gpu-aware-scheduling/deploy/gas-deployment.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,10 @@ spec:
- "--burst=100"
- "--qps=50"
- "--v=4"
resources:
requests:
cpu: 100m
memory: 50Mi
image: intel/gpu-extender
imagePullPolicy: IfNotPresent
securityContext:
Expand Down
16 changes: 16 additions & 0 deletions gpu-aware-scheduling/docs/example/allowed_gpu_list.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,9 @@ spec:
labels:
app: allow-gpu-list-example
spec:
securityContext:
seccompProfile:
type: RuntimeDefault
containers:
- name: &containername allow-gpu-list-example
image: busybox:1.33.1
Expand All @@ -26,5 +29,18 @@ spec:
value: *containername
command: ['sh', '-c', 'echo $MY_CONTAINER_NAME && ls -ltr /dev/dri && sleep 6000']
resources:
requests:
cpu: 10m
memory: 10Mi
limits:
cpu: 100m
memory: 100Mi
gpu.intel.com/i915: 1
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 10001
runAsGroup: 10001
capabilities:
drop: [ "ALL" ]
16 changes: 16 additions & 0 deletions gpu-aware-scheduling/docs/example/bb_example.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,11 +12,27 @@ spec:
labels:
app: bb-example
spec:
securityContext:
seccompProfile:
type: RuntimeDefault
containers:
- name: bb-example
image: busybox:1.33.1
command: ['sh', '-c', 'echo The gpu resource request app is running! && sleep 6000']
resources:
requests:
cpu: 10m
memory: 10Mi
limits:
cpu: 100m
memory: 100Mi
gpu.intel.com/i915: 1
gpu.intel.com/millicores: 100
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 10001
runAsGroup: 10001
capabilities:
drop: [ "ALL" ]
16 changes: 16 additions & 0 deletions gpu-aware-scheduling/docs/example/memory_resource_example.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,9 @@ spec:
labels:
app: memory-resource-example
spec:
securityContext:
seccompProfile:
type: RuntimeDefault
containers:
- name: &containername memory-resource-example
image: busybox:1.33.1
Expand All @@ -20,6 +23,19 @@ spec:
value: *containername
command: ['sh', '-c', 'echo $MY_CONTAINER_NAME && ls -ltr /dev/dri && sleep 6000']
resources:
requests:
cpu: 10m
memory: 10Mi
limits:
cpu: 100m
memory: 100Mi
gpu.intel.com/i915: 1
gpu.intel.com/memory.max: 500M
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 10001
runAsGroup: 10001
capabilities:
drop: [ "ALL" ]
55 changes: 55 additions & 0 deletions gpu-aware-scheduling/docs/example/same-gpu-example.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,9 @@ spec:
#List containers that needs to be in same GPU
gas-same-gpu: same-gpu-container1,same-gpu-container3
spec:
securityContext:
seccompProfile:
type: RuntimeDefault
containers:
- name: &container1 same-gpu-container1
image: busybox:1.33.1
Expand All @@ -23,36 +26,88 @@ spec:
value: *container1
command: ['sh', '-c', 'echo $MY_CONTAINER_NAME && ls -ltr /dev/dri && sleep 6000']
resources:
requests:
cpu: 10m
memory: 10Mi
limits:
cpu: 100m
memory: 100Mi
gpu.intel.com/i915: 1
gpu.intel.com/millicores: 400
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 10001
runAsGroup: 10001
capabilities:
drop: [ "ALL" ]
- name: &container2 same-gpu-container2
image: busybox:1.33.1
env:
- name: MY_CONTAINER_NAME
value: *container2
command: ['sh', '-c', 'echo $MY_CONTAINER_NAME && ls -ltr /dev/dri && sleep 6000']
resources:
requests:
cpu: 10m
memory: 10Mi
limits:
cpu: 100m
memory: 100Mi
gpu.intel.com/i915: 1
gpu.intel.com/millicores: 300
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 10001
runAsGroup: 10001
capabilities:
drop: [ "ALL" ]
- name: &container3 same-gpu-container3
image: busybox:1.33.1
env:
- name: MY_CONTAINER_NAME
value: *container3
command: ['sh', '-c', 'echo $MY_CONTAINER_NAME && ls -ltr /dev/dri && sleep 6000']
resources:
requests:
cpu: 10m
memory: 10Mi
limits:
cpu: 100m
memory: 100Mi
gpu.intel.com/i915: 1
gpu.intel.com/millicores: 400
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 10001
runAsGroup: 10001
capabilities:
drop: [ "ALL" ]
- name: &container4 same-gpu-container4
image: busybox:1.33.1
env:
- name: MY_CONTAINER_NAME
value: *container4
command: ['sh', '-c', 'echo $MY_CONTAINER_NAME && ls -ltr /dev/dri && sleep 6000']
resources:
requests:
cpu: 10m
memory: 10Mi
limits:
cpu: 100m
memory: 100Mi
gpu.intel.com/i915: 1
gpu.intel.com/millicores: 300
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 10001
runAsGroup: 10001
capabilities:
drop: [ "ALL" ]
16 changes: 16 additions & 0 deletions gpu-aware-scheduling/docs/example/tile_resource_request_example.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,9 @@ spec:
labels:
app: tile-resource-request-example
spec:
securityContext:
seccompProfile:
type: RuntimeDefault
containers:
- name: &containername tile-resource-request-example
image: busybox:1.33.1
Expand All @@ -20,6 +23,19 @@ spec:
value: *containername
command: ['sh', '-c', 'echo $MY_CONTAINER_NAME && ls -ltr /dev/dri && sleep 6000']
resources:
requests:
cpu: 10m
memory: 10Mi
limits:
cpu: 100m
memory: 100Mi
gpu.intel.com/i915: 1
gpu.intel.com/tiles: 1
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 10001
runAsGroup: 10001
capabilities:
drop: [ "ALL" ]
16 changes: 16 additions & 0 deletions gpu-aware-scheduling/docs/example/xe-link-example.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,9 @@ spec:
annotations:
gas-allocate-xelink: 'true'
spec:
securityContext:
seccompProfile:
type: RuntimeDefault
containers:
- name: &containername xe-link-example
image: busybox:1.33.1
Expand All @@ -22,6 +25,19 @@ spec:
value: *containername
command: ['sh', '-c', 'echo $MY_CONTAINER_NAME && ls -ltr /dev/dri && sleep 6000']
resources:
requests:
cpu: 10m
memory: 10Mi
limits:
cpu: 100m
memory: 100Mi
gpu.intel.com/i915: 2
gpu.intel.com/tiles: 2
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 10001
runAsGroup: 10001
capabilities:
drop: [ "ALL" ]

0 comments on commit e02f456

Please sign in to comment.