distributed-workloads: Security¶
Secrets¶
Kubernetes secrets referenced by this component. Only names and types are shown, not values.
Secrets Referenced¶
| Name | Type | Referenced By |
|---|---|---|
| kubeflow-trainer-webhook-cert | Opaque | deployment/kubeflow-trainer-controller-manager |
| kueue-webhook-server-cert | Opaque | deployment/controller-manager, deployment/kueue-controller-manager |
| webhook-server-cert | Opaque | deployment/controller-manager, deployment/kuberay-operator |
Deployment Security Controls¶
SecurityContext settings on pod and container specs. These control privilege escalation, filesystem access, and user identity.
Container Security Contexts¶
Build Security¶
Dockerfile patterns and base image analysis. Covers supply chain security: base images, build stages, runtime user, FIPS compliance.
| Path | Base Image | Stages | User | Ports | Architectures | FIPS | Issues |
|---|---|---|---|---|---|---|---|
.gomod-cache/github.com/kubeflow/trainer/v2@v2.1.0/cmd/data_cache/Dockerfile |
debian:bookworm-slim | 2 | cache_user | ||||
.gomod-cache/github.com/kubeflow/trainer/v2@v2.1.0/cmd/initializers/dataset/Dockerfile |
python:3.11-slim-bookworm | 1 | No USER directive found (defaults to root) | ||||
.gomod-cache/github.com/kubeflow/trainer/v2@v2.1.0/cmd/initializers/model/Dockerfile |
python:3.11-slim-bookworm | 1 | No USER directive found (defaults to root) | ||||
.gomod-cache/github.com/kubeflow/trainer/v2@v2.1.0/cmd/runtimes/deepspeed/Dockerfile |
nvidia/cuda:12.8.1-devel-ubuntu22.04 | 2 | No USER directive found (defaults to root) | ||||
.gomod-cache/github.com/kubeflow/trainer/v2@v2.1.0/cmd/runtimes/mlx/Dockerfile |
nvidia/cuda:12.8.1-devel-ubuntu22.04 | 2 | No USER directive found (defaults to root) | ||||
.gomod-cache/github.com/kubeflow/trainer/v2@v2.1.0/cmd/trainer-controller-manager/Dockerfile |
gcr.io/distroless/static:nonroot | 2 | No USER directive found (defaults to root) | ||||
.gomod-cache/github.com/kubeflow/trainer/v2@v2.1.0/cmd/trainers/torchtune/Dockerfile |
pytorch/pytorch:2.7.1-cuda12.8-cudnn9-runtime | 1 | No USER directive found (defaults to root) | ||||
.gomod-cache/github.com/kubeflow/training-operator@v1.7.0/build/images/training-operator/Dockerfile |
gcr.io/distroless/static:latest | 2 | Unpinned base image: gcr.io/distroless/static:latest; No USER directive found (defaults to root) | ||||
.gomod-cache/github.com/kubeflow/training-operator@v1.7.0/sdk/python/Dockerfile.conformance |
python:3.10-alpine | 1 | No USER directive found (defaults to root) | ||||
.gomod-cache/github.com/openshift/api@v0.0.0-20251124165233-999c45c0835a/Dockerfile.ocp |
registry.ci.openshift.org/ocp/4.21:base-rhel9 | 2 | No USER directive found (defaults to root) | ||||
.gomod-cache/github.com/openshift/kueue-operator@v0.0.0-20251202204851-958c48004dad/Dockerfile |
registry.redhat.io/ubi9/ubi-minimal@sha256:161a4e29ea482bab6048c2b36031b4f302ae81e4ff18b83e61785f40dc576f5d | 2 | 1001 | ||||
.gomod-cache/github.com/openshift/kueue-operator@v0.0.0-20251202204851-958c48004dad/Dockerfile.ci |
registry.ci.openshift.org/ocp/builder:rhel-9-base-openshift-4.19 | 2 | No USER directive found (defaults to root) | ||||
.gomod-cache/github.com/openshift/kueue-operator@v0.0.0-20251202204851-958c48004dad/Dockerfile.kueue |
registry.redhat.io/ubi9/ubi-minimal@sha256:161a4e29ea482bab6048c2b36031b4f302ae81e4ff18b83e61785f40dc576f5d | 2 | 65532:65532 | multi-arch | |||
.gomod-cache/github.com/openshift/kueue-operator@v0.0.0-20251202204851-958c48004dad/must-gather/Dockerfile |
registry.redhat.io/ubi9/ubi-minimal@sha256:161a4e29ea482bab6048c2b36031b4f302ae81e4ff18b83e61785f40dc576f5d | 2 | No USER directive found (defaults to root) | ||||
.gomod-cache/github.com/operator-framework/operator-lifecycle-manager@v0.38.0/Dockerfile |
gcr.io/distroless/static:debug | 1 | 1001 | ||||
.gomod-cache/github.com/prometheus/client_golang@v1.23.2/Dockerfile |
quay.io/prometheus/busybox:latest | 2 | Unpinned base image: quay.io/prometheus/busybox:latest; No USER directive found (defaults to root) | ||||
.gomod-cache/github.com/ray-project/kuberay/ray-operator@v1.5.1/Dockerfile |
gcr.io/distroless/base-debian12:nonroot | 3 | 65532:65532 | Unpinned base image: scratch | |||
.gomod-cache/github.com/ray-project/kuberay/ray-operator@v1.5.1/Dockerfile.buildx |
gcr.io/distroless/base-debian12:nonroot | 1 | 65532:65532 | multi-arch | |||
.gomod-cache/github.com/ray-project/kuberay/ray-operator@v1.5.1/Dockerfile.submitter.buildx |
scratch | 1 | 65532:65532 | multi-arch | Unpinned base image: scratch | ||
.gomod-cache/golang.org/toolchain@v0.0.1-go1.25.0.linux-amd64/src/crypto/internal/boring/Dockerfile |
$ubuntu:focal | 1 | No USER directive found (defaults to root) | ||||
.gomod-cache/golang.org/toolchain@v0.0.1-go1.25.0.linux-amd64/src/crypto/internal/fips140/nistec/fiat/Dockerfile |
coqorg/coq:8.13.2 | 1 | No USER directive found (defaults to root) | ||||
.gomod-cache/golang.org/x/net@v0.48.0/internal/quic/cmd/interop/Dockerfile |
martenseemann/quic-network-simulator-endpoint:latest | 2 | multi-arch | Unpinned base image: martenseemann/quic-network-simulator-endpoint:latest; Unpinned base image: martenseemann/quic-network-simulator-endpoint:latest; No USER directive found (defaults to root) | |||
.gomod-cache/golang.org/x/sys@v0.39.0/unix/linux/Dockerfile |
ubuntu:25.04 | 1 | No USER directive found (defaults to root) | ||||
.gomod-cache/sigs.k8s.io/jobset@v0.10.1/Dockerfile |
${BASE_IMAGE} | 2 | 65532:65532 | multi-arch | Unpinned base image: ${BUILDER_IMAGE}; Unpinned base image: ${BASE_IMAGE} | ||
.gomod-cache/sigs.k8s.io/jobset@v0.10.1/sdk/python/Dockerfile |
python:3.13 | 1 | No USER directive found (defaults to root) | ||||
.gomod-cache/sigs.k8s.io/kueue@v0.15.7/Dockerfile |
${BASE_IMAGE} | 2 | 65532:65532 | multi-arch | Unpinned base image: ${BUILDER_IMAGE}; Unpinned base image: ${BASE_IMAGE} | ||
.gomod-cache/sigs.k8s.io/kueue@v0.15.7/cmd/importer/Dockerfile |
${BASE_IMAGE} | 2 | 65532:65532 | multi-arch | Unpinned base image: ${BUILDER_IMAGE}; Unpinned base image: ${BASE_IMAGE} | ||
.gomod-cache/sigs.k8s.io/kueue@v0.15.7/cmd/kueueviz/frontend/Dockerfile |
node:25-slim | 2 | No USER directive found (defaults to root) | ||||
.gopath-loader/pkg/mod/github.com/kubeflow/trainer/v2@v2.1.0/cmd/data_cache/Dockerfile |
debian:bookworm-slim | 2 | cache_user | ||||
.gopath-loader/pkg/mod/github.com/kubeflow/trainer/v2@v2.1.0/cmd/initializers/dataset/Dockerfile |
python:3.11-slim-bookworm | 1 | No USER directive found (defaults to root) | ||||
.gopath-loader/pkg/mod/github.com/kubeflow/trainer/v2@v2.1.0/cmd/initializers/model/Dockerfile |
python:3.11-slim-bookworm | 1 | No USER directive found (defaults to root) | ||||
.gopath-loader/pkg/mod/github.com/kubeflow/trainer/v2@v2.1.0/cmd/runtimes/deepspeed/Dockerfile |
nvidia/cuda:12.8.1-devel-ubuntu22.04 | 2 | No USER directive found (defaults to root) | ||||
.gopath-loader/pkg/mod/github.com/kubeflow/trainer/v2@v2.1.0/cmd/runtimes/mlx/Dockerfile |
nvidia/cuda:12.8.1-devel-ubuntu22.04 | 2 | No USER directive found (defaults to root) | ||||
.gopath-loader/pkg/mod/github.com/kubeflow/trainer/v2@v2.1.0/cmd/trainer-controller-manager/Dockerfile |
gcr.io/distroless/static:nonroot | 2 | No USER directive found (defaults to root) | ||||
.gopath-loader/pkg/mod/github.com/kubeflow/trainer/v2@v2.1.0/cmd/trainers/torchtune/Dockerfile |
pytorch/pytorch:2.7.1-cuda12.8-cudnn9-runtime | 1 | No USER directive found (defaults to root) | ||||
.gopath-loader/pkg/mod/github.com/kubeflow/training-operator@v1.7.0/build/images/training-operator/Dockerfile |
gcr.io/distroless/static:latest | 2 | Unpinned base image: gcr.io/distroless/static:latest; No USER directive found (defaults to root) | ||||
.gopath-loader/pkg/mod/github.com/kubeflow/training-operator@v1.7.0/sdk/python/Dockerfile.conformance |
python:3.10-alpine | 1 | No USER directive found (defaults to root) | ||||
.gopath-loader/pkg/mod/github.com/openshift/api@v0.0.0-20251124165233-999c45c0835a/Dockerfile.ocp |
registry.ci.openshift.org/ocp/4.21:base-rhel9 | 2 | No USER directive found (defaults to root) | ||||
.gopath-loader/pkg/mod/github.com/openshift/kueue-operator@v0.0.0-20251202204851-958c48004dad/Dockerfile |
registry.redhat.io/ubi9/ubi-minimal@sha256:161a4e29ea482bab6048c2b36031b4f302ae81e4ff18b83e61785f40dc576f5d | 2 | 1001 | ||||
.gopath-loader/pkg/mod/github.com/openshift/kueue-operator@v0.0.0-20251202204851-958c48004dad/Dockerfile.ci |
registry.ci.openshift.org/ocp/builder:rhel-9-base-openshift-4.19 | 2 | No USER directive found (defaults to root) | ||||
.gopath-loader/pkg/mod/github.com/openshift/kueue-operator@v0.0.0-20251202204851-958c48004dad/Dockerfile.kueue |
registry.redhat.io/ubi9/ubi-minimal@sha256:161a4e29ea482bab6048c2b36031b4f302ae81e4ff18b83e61785f40dc576f5d | 2 | 65532:65532 | multi-arch | |||
.gopath-loader/pkg/mod/github.com/openshift/kueue-operator@v0.0.0-20251202204851-958c48004dad/must-gather/Dockerfile |
registry.redhat.io/ubi9/ubi-minimal@sha256:161a4e29ea482bab6048c2b36031b4f302ae81e4ff18b83e61785f40dc576f5d | 2 | No USER directive found (defaults to root) | ||||
.gopath-loader/pkg/mod/github.com/operator-framework/operator-lifecycle-manager@v0.38.0/Dockerfile |
gcr.io/distroless/static:debug | 1 | 1001 | ||||
.gopath-loader/pkg/mod/github.com/prometheus/client_golang@v1.23.2/Dockerfile |
quay.io/prometheus/busybox:latest | 2 | Unpinned base image: quay.io/prometheus/busybox:latest; No USER directive found (defaults to root) | ||||
.gopath-loader/pkg/mod/github.com/ray-project/kuberay/ray-operator@v1.5.1/Dockerfile |
gcr.io/distroless/base-debian12:nonroot | 3 | 65532:65532 | Unpinned base image: scratch | |||
.gopath-loader/pkg/mod/github.com/ray-project/kuberay/ray-operator@v1.5.1/Dockerfile.buildx |
gcr.io/distroless/base-debian12:nonroot | 1 | 65532:65532 | multi-arch | |||
.gopath-loader/pkg/mod/github.com/ray-project/kuberay/ray-operator@v1.5.1/Dockerfile.submitter.buildx |
scratch | 1 | 65532:65532 | multi-arch | Unpinned base image: scratch | ||
.gopath-loader/pkg/mod/golang.org/toolchain@v0.0.1-go1.25.0.linux-amd64/src/crypto/internal/boring/Dockerfile |
$ubuntu:focal | 1 | No USER directive found (defaults to root) | ||||
.gopath-loader/pkg/mod/golang.org/toolchain@v0.0.1-go1.25.0.linux-amd64/src/crypto/internal/fips140/nistec/fiat/Dockerfile |
coqorg/coq:8.13.2 | 1 | No USER directive found (defaults to root) | ||||
.gopath-loader/pkg/mod/golang.org/x/net@v0.48.0/internal/quic/cmd/interop/Dockerfile |
martenseemann/quic-network-simulator-endpoint:latest | 2 | multi-arch | Unpinned base image: martenseemann/quic-network-simulator-endpoint:latest; Unpinned base image: martenseemann/quic-network-simulator-endpoint:latest; No USER directive found (defaults to root) | |||
.gopath-loader/pkg/mod/golang.org/x/sys@v0.39.0/unix/linux/Dockerfile |
ubuntu:25.04 | 1 | No USER directive found (defaults to root) | ||||
.gopath-loader/pkg/mod/sigs.k8s.io/jobset@v0.10.1/Dockerfile |
${BASE_IMAGE} | 2 | 65532:65532 | multi-arch | Unpinned base image: ${BUILDER_IMAGE}; Unpinned base image: ${BASE_IMAGE} | ||
.gopath-loader/pkg/mod/sigs.k8s.io/jobset@v0.10.1/sdk/python/Dockerfile |
python:3.13 | 1 | No USER directive found (defaults to root) | ||||
.gopath-loader/pkg/mod/sigs.k8s.io/kueue@v0.15.7/Dockerfile |
${BASE_IMAGE} | 2 | 65532:65532 | multi-arch | Unpinned base image: ${BUILDER_IMAGE}; Unpinned base image: ${BASE_IMAGE} | ||
.gopath-loader/pkg/mod/sigs.k8s.io/kueue@v0.15.7/cmd/importer/Dockerfile |
${BASE_IMAGE} | 2 | 65532:65532 | multi-arch | Unpinned base image: ${BUILDER_IMAGE}; Unpinned base image: ${BASE_IMAGE} | ||
.gopath-loader/pkg/mod/sigs.k8s.io/kueue@v0.15.7/cmd/kueueviz/frontend/Dockerfile |
node:25-slim | 2 | No USER directive found (defaults to root) | ||||
benchmarks/osu-benchmarks/Dockerfile |
quay.io/opendatahub/odh-midstream-python-base-3-12:11b0d2c14a1d8de8171d428172aef0cde54ec7a7 | 2 | 1001 | ||||
benchmarks/osu-benchmarks/Dockerfile.cuda |
${TRAINING_BASE_IMAGE} | 1 | 1001 | Unpinned base image: ${TRAINING_BASE_IMAGE} | |||
images/dataset/alpaca/Dockerfile |
registry.access.redhat.com/ubi9:latest | 2 | Unpinned base image: registry.access.redhat.com/ubi9/python-311:latest; Unpinned base image: registry.access.redhat.com/ubi9:latest; No USER directive found (defaults to root) | ||||
images/model/bloom560m/Dockerfile |
registry.access.redhat.com/ubi9:9.4 | 2 | No USER directive found (defaults to root) | ||||
images/runtime/ray/cpu/2.52.1-py311-cpu/Dockerfile |
registry.access.redhat.com/ubi9/python-${PYTHON_VERSION}:${IMAGE_TAG} | 1 | 1001 | ||||
images/runtime/ray/cpu/2.52.1-py312-cpu/Dockerfile |
registry.access.redhat.com/ubi9/python-${PYTHON_VERSION}:${IMAGE_TAG} | 1 | 1001 | ||||
images/runtime/ray/cuda/2.52.1-py311-cu121/Dockerfile |
registry.access.redhat.com/ubi9/python-${PYTHON_VERSION}:${IMAGE_TAG} | 1 | 1001 | ||||
images/runtime/ray/cuda/2.55.1-py312-cu128/Dockerfile |
registry.access.redhat.com/ubi9/python-${PYTHON_VERSION}:${IMAGE_TAG} | 1 | 1001 | multi-arch | |||
images/runtime/ray/rocm/2.52.1-py311-rocm61/Dockerfile |
registry.access.redhat.com/ubi9/python-${PYTHON_VERSION}:${IMAGE_TAG} | 1 | 1001 | ||||
images/runtime/ray/rocm/2.55.1-py312-rocm64/Dockerfile |
registry.access.redhat.com/ubi9/python-${PYTHON_VERSION}:${IMAGE_TAG} | 1 | 1001 | ||||
images/runtime/training/py311-cuda121-torch241/Dockerfile |
registry.access.redhat.com/ubi9/python-${PYTHON_VERSION}:${IMAGE_TAG} | 1 | 1001 | ||||
images/runtime/training/py311-cuda121-torch241/Dockerfile.konflux |
registry.access.redhat.com/ubi9/python-311:latest | 1 | 1001 | Unpinned base image: registry.access.redhat.com/ubi9/python-311:latest | |||
images/runtime/training/py311-cuda124-torch251/Dockerfile |
registry.access.redhat.com/ubi9/python-${PYTHON_VERSION}:${IMAGE_TAG} | 1 | 1001 | ||||
images/runtime/training/py311-cuda124-torch251/Dockerfile.konflux |
registry.access.redhat.com/ubi9/python-311:latest | 1 | 1001 | Unpinned base image: registry.access.redhat.com/ubi9/python-311:latest | |||
images/runtime/training/py311-rocm62-torch241/Dockerfile |
registry.access.redhat.com/ubi9/python-${PYTHON_VERSION}:${IMAGE_TAG} | 1 | 1001 | ||||
images/runtime/training/py311-rocm62-torch241/Dockerfile.konflux |
registry.access.redhat.com/ubi9/python-311:latest | 1 | 1001 | Unpinned base image: registry.access.redhat.com/ubi9/python-311:latest | |||
images/runtime/training/py311-rocm62-torch251/Dockerfile |
registry.access.redhat.com/ubi9/python-${PYTHON_VERSION}:${IMAGE_TAG} | 1 | 1001 | ||||
images/runtime/training/py311-rocm62-torch251/Dockerfile.konflux |
registry.access.redhat.com/ubi9/python-311:latest | 1 | 1001 | Unpinned base image: registry.access.redhat.com/ubi9/python-311:latest | |||
images/runtime/training/py312-cuda128-torch280/Dockerfile |
registry.access.redhat.com/ubi9/python-${PYTHON_VERSION}:${IMAGE_TAG} | 1 | 1001 | ||||
images/runtime/training/py312-cuda128-torch280/Dockerfile.konflux |
registry.access.redhat.com/ubi9/python-312:latest | 1 | 1001 | Unpinned base image: registry.access.redhat.com/ubi9/python-312:latest | |||
images/runtime/training/py312-cuda128-torch290/Dockerfile |
registry.access.redhat.com/ubi9/python-${PYTHON_VERSION}:${IMAGE_TAG} | 1 | 1001 | ||||
images/runtime/training/py312-cuda128-torch290/Dockerfile.konflux |
registry.access.redhat.com/ubi9/python-312@sha256:a0a5885769d5a8c5123d3b15d5135b254541d4da8e7bc445d95e1c90595de470 | 1 | 1001 | ||||
images/runtime/training/py312-cuda130-torch210-openmpi41/Dockerfile |
quay.io/opendatahub/odh-midstream-cuda-base-13-0:odh-midstream-cuda-base-13-0-on-push-p7nn6-build-images | 1 | 1001 | ||||
images/runtime/training/py312-cuda130-torch210-openmpi41/Dockerfile.konflux |
quay.io/aipcc/base-images/cuda-13.0-el9.6@sha256:3de8a37c9172aea6a15fe12aeeb9fd6be09a5a5ca419ec2e9fc2e16c3f0b138d | 1 | 1001 | ||||
images/runtime/training/py312-rocm64-torch280/Dockerfile |
registry.access.redhat.com/ubi9/python-${PYTHON_VERSION}:${IMAGE_TAG} | 1 | 1001 | ||||
images/runtime/training/py312-rocm64-torch280/Dockerfile.konflux |
registry.access.redhat.com/ubi9/python-312:latest | 1 | 1001 | Unpinned base image: registry.access.redhat.com/ubi9/python-312:latest | |||
images/runtime/training/py312-rocm64-torch29-openmpi41/Dockerfile.konflux |
quay.io/aipcc/base-images/rocm-6.4-el9.6@sha256:444b1345c0bcf09ae1cb9a4f618c349522930021c8fc3e105276768beaf322cd | 1 | 1001 | ||||
images/runtime/training/py312-rocm64-torch290/Dockerfile |
registry.access.redhat.com/ubi9/python-${PYTHON_VERSION}:${IMAGE_TAG} | 1 | 1001 | ||||
images/runtime/training/py312-rocm64-torch290/Dockerfile.konflux |
registry.access.redhat.com/ubi9/python-312@sha256:a0a5885769d5a8c5123d3b15d5135b254541d4da8e7bc445d95e1c90595de470 | 1 | 1001 | ||||
images/universal/training/th06-cpu-torch210-py312/Dockerfile |
${BASE_IMAGE} | 2 | 1001 | Unpinned base image: ${BASE_IMAGE}; Unpinned base image: ${BASE_IMAGE} | |||
images/universal/training/th06-cpu-torch210-py312/Dockerfile.konflux.cpu |
${BASE_IMAGE} | 2 | 1001 | Unpinned base image: ${BASE_IMAGE}; Unpinned base image: ${BASE_IMAGE} | |||
images/universal/training/th06-cuda130-torch210-py312/Dockerfile |
${BASE_IMAGE} | 2 | 1001 | Unpinned base image: ${BASE_IMAGE}; Unpinned base image: ${BASE_IMAGE} | |||
images/universal/training/th06-cuda130-torch210-py312/Dockerfile.konflux.cuda |
${BASE_IMAGE} | 2 | 1001 | Unpinned base image: ${BASE_IMAGE}; Unpinned base image: ${BASE_IMAGE} | |||
images/universal/training/th06-rocm64-torch291-py312/Dockerfile |
${BASE_IMAGE} | 2 | 1001 | Unpinned base image: ${BASE_IMAGE}; Unpinned base image: ${BASE_IMAGE} | |||
images/universal/training/th06-rocm64-torch291-py312/Dockerfile.konflux.rocm |
${BASE_IMAGE} | 2 | 1001 | Unpinned base image: ${BASE_IMAGE}; Unpinned base image: ${BASE_IMAGE} | |||
images/util/mc-cli/Dockerfile |
registry.access.redhat.com/ubi9:latest | 1 | 1001 | Unpinned base image: registry.access.redhat.com/ubi9:latest |