Kubernetes v1.37 In-Place Pod Resize Scheduler Preemption & Resource Contention Fix

Key Vulnerability Information Summary Vulnerability Overview Vulnerability Type: Resource Contention / Scheduling Blockage (not a traditional security vulnerability; classified as a functional defect / scheduling mechanism issue) Core Issue: In Kubernetes, when node resources are saturated by low-priority workloads, in-place resize requests from high-priority Pods are marked with the status and remain pending indefinitely, preventing high-priority applications from obtaining the required resources. Trigger Conditions: Node resource exhaustion + in-place resize initiated by a high-priority Pod + low-priority Pods occupying resources without releasing them. Impact Scope Affected Versions: Kubernetes v1.37 (Alpha feature) Affected Components: Kubelet, Scheduler, In-place Pod Resize mechanism Affected Targets: High-priority workloads relying on in-place resize (e.g., critical business applications, real-time systems) Impact Manifestation: Resize requests from high-priority Pods are blocked, preventing the completion of scaling operations, which may lead to service performance degradation or functional limitations. Fix Solution Fixed Version: Kubernetes v1.37 introduced the Scheduler Preemption for In-Place Pod Resize feature (Alpha) Fix Mechanism: - The scheduler actively coordinates resources, allowing high-priority Pods to preempt low-priority Pods to free up resources. - Introduction of the feature gate. - Support for node-level preemption configuration, controllable via the field. Configuration Example: POC / Exploit Code Test Environment Setup: Deploy Test Pods: Verification Commands: Expected Result: - The low-priority Pod occupies 1 CPU, while the high-priority Pod requests 1 CPU. - With only 8 allocatable CPUs on the node, the resize request from the high-priority Pod should trigger preemption, releasing resources from the low-priority Pod.

Goal Reached Thanks to every supporter — we hit 100%!

Kubernetes v1.37 In-Place Pod Resize Scheduler Preemption & Resource Contention Fix