huggingface / Google-Cloud-Containers

Hugging Face Deep Learning Containers (DLCs) for Google Cloud
https://hf.co/docs/google-cloud
Apache License 2.0
131 stars 18 forks source link

Disable insecure `kubelet` unauthenticated read-only port for GKE #94

Closed alvarobartt closed 2 months ago

alvarobartt commented 2 months ago

Description

We should update the gcloud container clusters create-auto commands within the examples/gke so that the flag --no-autoprovisioning-enable-insecure-kubelet-readonly-port is set to prevent the following warning:

Unauthenticated "read-only" port (10255) in the Kubelet server, which could result in a potential data leak or compromise, if not turned off.

Whilst the port 10255 will be automatically disabled in GKE version 1.32 and higher, we should still add that flag to the current commands to prevent that port from being exposed.

Thanks to @paulinebm for flagging!