Skip to content

fix: set restricted PSS sample context #1229

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
google-oss-prow merged 1 commit into from
Jul 30, 2026
+12 −0
Merged

fix: set restricted PSS sample context #1229

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions workspaces/controller/manifests/kustomize/samples/codeserver_v1beta1_workspacekind.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,12 +51,16 @@ spec:
medium: "Memory"
securityContext:
fsGroup: 100
seccompProfile:
type: RuntimeDefault
containerSecurityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
options:
imageConfig:
spawner:
Expand Down
4 changes: 4 additions & 0 deletions workspaces/controller/manifests/kustomize/samples/jupyterlab_v1beta1_workspacekind.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -226,6 +226,8 @@ spec:
##
securityContext:
fsGroup: 100
seccompProfile:
type: RuntimeDefault
Comment on lines +229 to +230

@thesuperzapper thesuperzapper Jul 7, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should sanity check that this does not break accelerator intergration for NVIDIA or AMD GPUs.

cc @christian-heusel

@christian-heusel christian-heusel Jul 29, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Atleast AMD GPUs are still working (installed via this guide):

$ python -c "import torch; print(torch.cuda.is_available()); print(torch.cuda.get_device_name())"
True
AMD Radeon 8060S Graphics
Click to show full StatefulSet definition 
apiVersion: apps/v1
kind: StatefulSet
metadata:
  creationTimestamp: "2026-07-29T18:38:59Z"
  generateName: ws-test-with-gpu-
  generation: 1
  labels:
    notebooks.kubeflow.org/workspace-name: test-with-gpu
  name: ws-test-with-gpu-87jw6
  namespace: default
  ownerReferences:
  - apiVersion: kubeflow.org/v1beta1
    blockOwnerDeletion: true
    controller: true
    kind: Workspace
    name: test-with-gpu
    uid: dfe65316-2c56-4702-a56d-59deac3a6d69
  resourceVersion: "1350294"
  uid: 9462d850-b3cd-4bec-83f7-104d73bdda34
spec:
  persistentVolumeClaimRetentionPolicy:
    whenDeleted: Retain
    whenScaled: Retain
  podManagementPolicy: OrderedReady
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      notebooks.kubeflow.org/workspace-name: test-with-gpu
      statefulset: test-with-gpu
  serviceName: ""
  template:
    metadata:
      annotations:
        my-workspace-kind-annotation: my-value
      labels:
        my-workspace-kind-label: my-value
        notebooks.kubeflow.org/workspace-name: test-with-gpu
        statefulset: test-with-gpu
    spec:
      affinity: {}
      containers:
      - env:
        - name: NB_PREFIX
          value: /workspace/connect/default/test-with-gpu/jupyterlab/
        image: ghcr.io/kubeflow/kubeflow/notebook-servers/jupyter-scipy:v1.10.0
        imagePullPolicy: IfNotPresent
        name: main
        ports:
        - containerPort: 8888
          name: http-8888
          protocol: TCP
        resources:
          limits:
            amd.com/gpu: "1"
          requests:
            cpu: "4"
            memory: 16Gi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          runAsNonRoot: true
          seccompProfile:
            type: RuntimeDefault
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /home/jovyan
          name: home-volume
        - mountPath: /dev/shm
          name: dshm
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext:
        fsGroup: 100
        seccompProfile:
          type: RuntimeDefault
      serviceAccount: default-editor
      serviceAccountName: default-editor
      terminationGracePeriodSeconds: 30
      tolerations:
      - effect: NoSchedule
        key: amd.com/gpu
        operator: Exists
      volumes:
      - name: home-volume
        persistentVolumeClaim:
          claimName: test-with-gpu
      - emptyDir:
          medium: Memory
        name: dshm
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 1
      partition: 0
    type: RollingUpdate
status:
  availableReplicas: 1
  collisionCount: 0
  currentReplicas: 1
  currentRevision: ws-test-with-gpu-87jw6-6b7b7f5bfd
  observedGeneration: 1
  readyReplicas: 1
  replicas: 1
  updateRevision: ws-test-with-gpu-87jw6-6b7b7f5bfd
  updatedReplicas: 1

@christian-heusel christian-heusel Jul 29, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also judging from https://docs.cloud.google.com/kubernetes-engine/docs/concepts/seccomp-in-gke#denied-defaults this should mostly be sane 🤔


## container SecurityContext for Workspace Pods (MUTABLE)
## - spec for SecurityContext:
Expand All @@ -237,6 +239,8 @@ spec:
drop:
- ALL
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault

## ==============================================================
## WORKSPACE OPTIONS
Expand Down
4 changes: 4 additions & 0 deletions workspaces/controller/manifests/kustomize/samples/rstudio_v1beta1_workspacekind.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,12 +54,16 @@ spec:
medium: "Memory"
securityContext:
fsGroup: 100
seccompProfile:
type: RuntimeDefault
containerSecurityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
options:
imageConfig:
spawner:
Expand Down