spec: security and isolators conflated?

[thockin]

Regarding capabilities as an isolator. This is counter to what Red Hat and Kubernetes hammered out. Security is very different from performance and resource isolation. I'm not a security buff, but I find this awkward. Apologies if this has been done to death.

[jonboulle]

Reference to "what Red Hat and Kubernetes hammered out"?

[thockin]

https://github.com/GoogleCloudPlatform/kubernetes/pull/3910/files

kubernetes/kubernetes#7343

A wholly distinct type for security

[jonboulle]

@thockin I am wondering how much exactly this needs to be teased apart; we already have some distinction between "resource isolators" and "other isolators" (currently, just Linux isolators). What if we just codify that more formally as "resource isolators" and "security isolators"?

[thockin]

Sorry for being absentee - I'm slammed.

My main point with this is that I was surprised to see these (to me) very different ideas being managed by the same mechanism. I'm not actually deeply familiar with all the use cases around security, sadly.