Security assesment

[Vin3ntKing]

Some of my naive thoughts when I cannot sleep at night:

Since the data flow is:

[ External ] <--> [ Yarn/Spark APIs/UIs ] <--> [ Yarn Master ] <--> [ Yarn NodeManager ] <--> [ Container (Regular/Kata) ] <--> [Data Storage ]

Then, the potential security tests can be launched at the following points:

[ User ] --> [ Yarn Master ] --> [ Yarn NodeManager ] --> [ Container ] --> [ Spark Executor/Driver ] --> [ Data ]
             |                  |                    |                   |
          (Access Control)  (Isolation Test)   (Network Test)       (Resource Test)

And for each attack/test, we could think as:

[ External Attacker ] --\
                         \
[ Malicious Internal User ] --> [ Yarn/Spark APIs/UIs ]
                         /
[ Compromised Container ] --/

[Vin3ntKing]

Done with brief documentation in security level comparison between regular container and kata-container and in the context of Yarn + Spark.

1. Regular Container vs. Kata Container
2. Security Comparison: runc Containers vs. Kata Containers
3. Multi-tenancy with Yarn + Spark: runc Containers vs. Kata Containers