kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfs_quota_us is used (e.g., with Kubernetes), allows attackers to cause a denial of service against non-cpu-bound applications by generating a workload that triggers unwanted slice expiration, aka CID-de53fd7aedb1. (In other words, although this slice expiration would typically be seen with benign workloads, it is possible that an attacker could calculate how many stray requests are required to force an entire Kubernetes cluster into a low-performance state caused by slice expiration, and ensure that a DDoS attack sent that number of stray requests. An attack does not affect the stability of the kernel; it only causes mismanagement of application execution.)
> /kind bug

This is not a bug in Kubernets per se, it's more of a heads-up.

I've read this great blog post:

* https://kubernetes.io/blog/2018/07/24/feature-highlight-cpu-manager/

From the blog post I learned that k8s is using cfs quotas to enforce CPU limits. Unfortunately, those can lead to unnecessary throttling, especially for well behaved tenants.

See this unresolved bug in Linux kernel I filed a while back:

* https://bugzilla.kernel.org/show_bug.cgi?id=198197

There's an open and stalled patch that addresses the issue (I've not verified if it works):

* https://lore.kernel.org/patchwork/cover/907448/

cc @ConnorDoyle @balajismaniam
CFS quotas can lead to unnecessary throttling
This is a GitHub Issue
repo:kubernetes
owner:kubernetes
Title : CFS quotas can lead to unnecessary throttling
Issue date:

--- start body ---
> /kind bug

This is not a bug in Kubernets per se, it's more of a heads-up.

I've read this great blog post:

* https://kubernetes.io/blog/2018/07/24/feature-highlight-cpu-manager/

From the blog post I learned that k8s is using cfs quotas to enforce CPU limits. Unfortunately, those can lead to unnecessary throttling, especially for well behaved tenants.

See this unresolved bug in Linux kernel I filed a while back:

* https://bugzilla.kernel.org/show_bug.cgi?id=198197

There's an open and stalled patch that addresses the issue (I've not verified if it works):

* https://lore.kernel.org/patchwork/cover/907448/

cc @ConnorDoyle @balajismaniam
--- end body ---
