Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Performance] Use OpenJ9 CDS capability #7

Open
mbarbero opened this issue Feb 6, 2019 · 0 comments
Open

[Performance] Use OpenJ9 CDS capability #7

mbarbero opened this issue Feb 6, 2019 · 0 comments

Comments

@mbarbero
Copy link
Member

mbarbero commented Feb 6, 2019

Class Data Sharing may help improve startup time and memory consumption for both masters and agents (jnlp).

For masters, it would mean mounting a folder from the host (https://kubernetes.io/docs/concepts/storage/volumes/#hostpath) and use it as the cache. It requires some changes in scc/podsecuritypolicy as today hostPath volumes cannot be mounted by masters' service accounts. It's not wise to give more permissions to this service account until we split masters and agents as specified in #5.

For agents, it's TBD. Regarding security, it may be unsafe to allow agents to mount hostPath (e.g. /var/lib/docker).

Note:
PodSecurityPolicy offers fine grain policy that let specifies a whitelist of host paths that are allowed to be used by hostPath volumes. PodSecurityPolicies are not available on OpenShift 3.9 (but is a beta feature in 3.11). There is only SecurityContextConstraint which provide hostPath access on a all or nothing basis

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant