Volcano (admission webhook server, unbounded HTTP request body): The Volcano webhook server accepts request bodies of

Impact

The Volcano webhook server accepts request bodies of any size, so any pod in the cluster can OOM-kill it. When the admission webhook is down, Volcano job and pod admission fails, which stalls GPU scheduling for every tenant that goes through Volcano.

Who can reach it

Any in-cluster pod that can reach the Volcano webhook service endpoint. Requires only network reach, not Volcano permissions.

What to do

Upgrade Volcano to 1.12.4, 1.13.3 or 1.14.2 and restart the webhook deployment. In the meantime restrict the webhook Service with a NetworkPolicy so only the API server can reach it, and set a memory limit on the webhook pod.

References