docs: add GCE and GKE documentation for running NPI benchmarks#126
docs: add GCE and GKE documentation for running NPI benchmarks#126kislaykishore wants to merge 16 commits into
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces documentation for running Network Performance Improvement (NPI) benchmarks on GCE and GKE. The guides cover building Docker images, setting up prerequisites, and executing benchmarks via a Python script on GCE or Kubernetes Pods on GKE. Feedback was provided to enhance the security of the GKE instructions by recommending the principle of least privilege for IAM roles and removing unnecessary privileged execution modes in the Pod configurations.
| # Grant Storage Object Admin (or a more restricted role) on your bucket | ||
| gcloud storage buckets add-iam-policy-binding gs://YOUR_BUCKET_NAME \ | ||
| --member "serviceAccount:benchmark-gsa@YOUR_PROJECT_ID.iam.gserviceaccount.com" \ | ||
| --role "roles/storage.objectAdmin" |
There was a problem hiding this comment.
The roles/storage.objectAdmin role is overly permissive as it allows management of the bucket itself (e.g., deleting the bucket or changing its IAM policy). For benchmarking, roles/storage.objectUser is a more secure alternative that provides full access to objects (read, write, delete) without bucket-level administrative permissions, adhering to the principle of least privilege.
| --role "roles/storage.objectAdmin" | |
| --role "roles/storage.objectUser" |
| securityContext: | ||
| privileged: true | ||
| volumeMounts: |
There was a problem hiding this comment.
The privileged: true setting is likely unnecessary and poses a security risk. Since the GKE GCS Fuse CSI driver handles the mounting process and the benchmark container simply accesses the data through a pre-mounted volume (--mount-path=/data), the container does not need elevated privileges. Removing this allows the Pod to run under more restrictive security policies (e.g., the GKE baseline or restricted Pod Security Standards).
| securityContext: | |
| privileged: true | |
| volumeMounts: | |
| volumeMounts: |
1 participant
No description provided.