Restricting User-Controlled Kubernetes Pods
Cloudera Machine Learning includes three properties that allow you to control the permissions granted to user-controlled Kubernetes pods.
Required Role: Site Administrator
An example of a user-controlled pod is the engine pod, which provides the environment for sessions, jobs, etc. These pods are launched in a per-user Kubernetes namespace. Since the user has the ability to launch arbitrary pods, these settings restrict what those pods can do.
They are available under the site administrator panel at under the Control of User-Created Kubernetes Pods section.
Do not modify these settings unless you need to run pods that require special privileges. Enabling any of these properties puts CML user data at risk.
Allow privileged pod containers
Pod containers that are "privileged" are extraordinarily powerful. Processes within such containers get almost the same privileges that are available to processes outside the container.
If this property is enabled, a privileged container could potentially access all data on the host.
This property is disabled by default .
Allow pod containers to mount unsupported volume types
The volumes that can be mounted inside a container in a Kubernetes pod are already heavily restricted. Access is normally denied to volume types that are unfamiliar, such as GlusterFS, Cinder, Fibre Channel, etc. If this property is enabled, pods will be able to mount all unsupported volume types.
This property is disabled by default .
