Skip to content

feat: Add configurable security context support to Katib controller pods #2618

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
jsonmp-k8 wants to merge 2 commits into from
Closed

feat: Add configurable security context support to Katib controller pods #2618

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
10b1353
feat: Add configurable security context support to Katib controller pods
Feb 7, 2026
4f25812
fix: gofmt alignment and add USER directives to all Dockerfiles
jsonmp-k8 Feb 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion cmd/earlystopping/medianstop/v1beta1/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,10 @@ ADD ./${EARLY_STOPPING_DIR}/ ${TARGET_DIR}/${EARLY_STOPPING_DIR}/
WORKDIR ${TARGET_DIR}/${EARLY_STOPPING_DIR}

RUN pip install --prefer-binary --no-cache-dir -r requirements.txt
RUN chgrp -R 0 ${TARGET_DIR} \
RUN useradd -m -u 1000 katib \
&& chgrp -R 0 ${TARGET_DIR} \
&& chmod -R g+rwX ${TARGET_DIR}

USER 1000

ENTRYPOINT ["python", "main.py"]
7 changes: 7 additions & 0 deletions cmd/metricscollector/v1beta1/file-metricscollector/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,4 +21,11 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} go build -a -o file-metricscol
FROM alpine:3.15
WORKDIR /app
COPY --from=build-env /go/src/github.com/kubeflow/katib/file-metricscollector .

RUN adduser -S -u 1000 katib \
&& chgrp -R 0 /app \
&& chmod -R g+rwX /app

USER 1000

ENTRYPOINT ["./file-metricscollector"]
5 changes: 4 additions & 1 deletion cmd/metricscollector/v1beta1/tfevent-metricscollector/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,10 @@ RUN if [ "${TARGETARCH}" = "arm64" ]; then \
fi

RUN pip install --prefer-binary --no-cache-dir -r requirements.txt
RUN chgrp -R 0 ${TARGET_DIR} \
RUN useradd -m -u 1000 katib \
&& chgrp -R 0 ${TARGET_DIR} \
&& chmod -R g+rwX ${TARGET_DIR}

USER 1000

ENTRYPOINT ["python", "main.py"]
5 changes: 4 additions & 1 deletion cmd/suggestion/goptuna/v1beta1/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,10 @@ WORKDIR ${TARGET_DIR}

COPY --from=build-env /go/src/github.com/kubeflow/katib/goptuna-suggestion ${TARGET_DIR}/

RUN chgrp -R 0 ${TARGET_DIR} \
RUN adduser -S -u 1000 katib \
&& chgrp -R 0 ${TARGET_DIR} \
&& chmod -R g+rwX ${TARGET_DIR}

USER 1000

ENTRYPOINT ["./goptuna-suggestion"]
5 changes: 4 additions & 1 deletion cmd/suggestion/hyperband/v1beta1/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,10 @@ ADD ./${SUGGESTION_DIR}/ ${TARGET_DIR}/${SUGGESTION_DIR}/
WORKDIR ${TARGET_DIR}/${SUGGESTION_DIR}

RUN pip install --prefer-binary --no-cache-dir -r requirements.txt
RUN chgrp -R 0 ${TARGET_DIR} \
RUN useradd -m -u 1000 katib \
&& chgrp -R 0 ${TARGET_DIR} \
&& chmod -R g+rwX ${TARGET_DIR}

USER 1000

ENTRYPOINT ["python", "main.py"]
5 changes: 4 additions & 1 deletion cmd/suggestion/hyperopt/v1beta1/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,10 @@ ADD ./${SUGGESTION_DIR}/ ${TARGET_DIR}/${SUGGESTION_DIR}/
WORKDIR ${TARGET_DIR}/${SUGGESTION_DIR}

RUN pip install --prefer-binary --no-cache-dir -r requirements.txt
RUN chgrp -R 0 ${TARGET_DIR} \
RUN useradd -m -u 1000 katib \
&& chgrp -R 0 ${TARGET_DIR} \
&& chmod -R g+rwX ${TARGET_DIR}

USER 1000

ENTRYPOINT ["python", "main.py"]
5 changes: 4 additions & 1 deletion cmd/suggestion/nas/darts/v1beta1/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,10 @@ ADD ./${SUGGESTION_DIR}/ ${TARGET_DIR}/${SUGGESTION_DIR}/
WORKDIR ${TARGET_DIR}/${SUGGESTION_DIR}

RUN pip install --prefer-binary --no-cache-dir -r requirements.txt
RUN chgrp -R 0 ${TARGET_DIR} \
RUN useradd -m -u 1000 katib \
&& chgrp -R 0 ${TARGET_DIR} \
&& chmod -R g+rwX ${TARGET_DIR}

USER 1000

ENTRYPOINT ["python", "main.py"]
5 changes: 4 additions & 1 deletion cmd/suggestion/nas/enas/v1beta1/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,10 @@ ADD ./${SUGGESTION_DIR}/ ${TARGET_DIR}/${SUGGESTION_DIR}/
WORKDIR ${TARGET_DIR}/${SUGGESTION_DIR}

RUN pip install --prefer-binary --no-cache-dir -r requirements.txt
RUN chgrp -R 0 ${TARGET_DIR} \
RUN useradd -m -u 1000 katib \
&& chgrp -R 0 ${TARGET_DIR} \
&& chmod -R g+rwX ${TARGET_DIR}

USER 1000

ENTRYPOINT ["python", "main.py"]
5 changes: 4 additions & 1 deletion cmd/suggestion/optuna/v1beta1/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,10 @@ ADD ./${SUGGESTION_DIR}/ ${TARGET_DIR}/${SUGGESTION_DIR}/
WORKDIR ${TARGET_DIR}/${SUGGESTION_DIR}

RUN pip install --prefer-binary --no-cache-dir -r requirements.txt
RUN chgrp -R 0 ${TARGET_DIR} \
RUN useradd -m -u 1000 katib \
&& chgrp -R 0 ${TARGET_DIR} \
&& chmod -R g+rwX ${TARGET_DIR}

USER 1000

ENTRYPOINT ["python", "main.py"]
5 changes: 4 additions & 1 deletion cmd/suggestion/pbt/v1beta1/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,10 @@ ADD ./${SUGGESTION_DIR}/ ${TARGET_DIR}/${SUGGESTION_DIR}/
WORKDIR ${TARGET_DIR}/${SUGGESTION_DIR}

RUN pip install --prefer-binary --no-cache-dir -r requirements.txt
RUN chgrp -R 0 ${TARGET_DIR} \
RUN useradd -m -u 1000 katib \
&& chgrp -R 0 ${TARGET_DIR} \
&& chmod -R g+rwX ${TARGET_DIR}

USER 1000

ENTRYPOINT ["python", "main.py"]
5 changes: 4 additions & 1 deletion cmd/suggestion/skopt/v1beta1/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,10 @@ ADD ./${SUGGESTION_DIR}/ ${TARGET_DIR}/${SUGGESTION_DIR}/
WORKDIR ${TARGET_DIR}/${SUGGESTION_DIR}

RUN pip install --prefer-binary --no-cache-dir -r requirements.txt
RUN chgrp -R 0 ${TARGET_DIR} \
RUN useradd -m -u 1000 katib \
&& chgrp -R 0 ${TARGET_DIR} \
&& chmod -R g+rwX ${TARGET_DIR}

USER 1000

ENTRYPOINT ["python", "main.py"]
76 changes: 76 additions & 0 deletions manifests/v1beta1/installs/katib-cert-manager/katib-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,37 +15,101 @@ runtime:
metricsCollectors:
- kind: StdOut
image: ghcr.io/kubeflow/katib/file-metrics-collector:latest
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
- kind: File
image: ghcr.io/kubeflow/katib/file-metrics-collector:latest
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
- kind: TensorFlowEvent
image: ghcr.io/kubeflow/katib/tfevent-metrics-collector:latest
resources:
limits:
memory: 1Gi
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
suggestions:
- algorithmName: random
image: ghcr.io/kubeflow/katib/suggestion-hyperopt:latest
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
- algorithmName: tpe
image: ghcr.io/kubeflow/katib/suggestion-hyperopt:latest
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
- algorithmName: grid
image: ghcr.io/kubeflow/katib/suggestion-optuna:latest
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
- algorithmName: hyperband
image: ghcr.io/kubeflow/katib/suggestion-hyperband:latest
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
- algorithmName: bayesianoptimization
image: ghcr.io/kubeflow/katib/suggestion-skopt:latest
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
- algorithmName: cmaes
image: ghcr.io/kubeflow/katib/suggestion-goptuna:latest
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
- algorithmName: sobol
image: ghcr.io/kubeflow/katib/suggestion-goptuna:latest
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
- algorithmName: multivariate-tpe
image: ghcr.io/kubeflow/katib/suggestion-optuna:latest
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
- algorithmName: enas
image: ghcr.io/kubeflow/katib/suggestion-enas:latest
resources:
limits:
memory: 400Mi
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
- algorithmName: darts
image: ghcr.io/kubeflow/katib/suggestion-darts:latest
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
- algorithmName: pbt
image: ghcr.io/kubeflow/katib/suggestion-pbt:latest
persistentVolumeClaimSpec:
Expand All @@ -54,6 +118,18 @@ runtime:
resources:
requests:
storage: 5Gi
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
earlyStoppings:
- algorithmName: medianstop
image: ghcr.io/kubeflow/katib/earlystopping-medianstop:latest
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
76 changes: 76 additions & 0 deletions manifests/v1beta1/installs/katib-external-db/katib-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,37 +16,101 @@ runtime:
metricsCollectors:
- kind: StdOut
image: ghcr.io/kubeflow/katib/file-metrics-collector:latest
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
- kind: File
image: ghcr.io/kubeflow/katib/file-metrics-collector:latest
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
- kind: TensorFlowEvent
image: ghcr.io/kubeflow/katib/tfevent-metrics-collector:latest
resources:
limits:
memory: 1Gi
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
suggestions:
- algorithmName: random
image: ghcr.io/kubeflow/katib/suggestion-hyperopt:latest
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
- algorithmName: tpe
image: ghcr.io/kubeflow/katib/suggestion-hyperopt:latest
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
- algorithmName: grid
image: ghcr.io/kubeflow/katib/suggestion-optuna:latest
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
- algorithmName: hyperband
image: ghcr.io/kubeflow/katib/suggestion-hyperband:latest
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
- algorithmName: bayesianoptimization
image: ghcr.io/kubeflow/katib/suggestion-skopt:latest
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
- algorithmName: cmaes
image: ghcr.io/kubeflow/katib/suggestion-goptuna:latest
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
- algorithmName: sobol
image: ghcr.io/kubeflow/katib/suggestion-goptuna:latest
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
- algorithmName: multivariate-tpe
image: ghcr.io/kubeflow/katib/suggestion-optuna:latest
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
- algorithmName: enas
image: ghcr.io/kubeflow/katib/suggestion-enas:latest
resources:
limits:
memory: 400Mi
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
- algorithmName: darts
image: ghcr.io/kubeflow/katib/suggestion-darts:latest
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
- algorithmName: pbt
image: ghcr.io/kubeflow/katib/suggestion-pbt:latest
persistentVolumeClaimSpec:
Expand All @@ -55,6 +119,18 @@ runtime:
resources:
requests:
storage: 5Gi
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
earlyStoppings:
- algorithmName: medianstop
image: ghcr.io/kubeflow/katib/earlystopping-medianstop:latest
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
Loading