[mertcano]

Description

This PR hardens the security posture of the inference-benchmarks environment across secret generation scripts, container definitions, and Kubernetes CronJob manifests[cite: 30, 31, 32, 33]. It eliminates insecure credential passing vectors, enforces least-privilege container execution, and prevents dangerous non-atomic secret rotation behaviors[cite: 30, 31, 32, 33].

Key Changes

• Secure Secret Provisioning (aiperf/create-secret.sh, aiperf/create-api-key-secret.sh):
  • Removed insecure command-line argument passing for sensitive credentials, preventing leaks via process lists (ps) and shell command histories[cite: 30].
  • Replaced dangerous source file execution with explicit, line-by-line parsing for expected keys (CLIENT_ID, CLIENT_SECRET)[cite: 30].
  • Replaced non-atomic delete-then-create secret deployment steps with idempotent, safe dry-run apply patterns (kubectl create ... --dry-run=client -o yaml | kubectl apply -f -)[cite: 30, 33].
• Container Hardening (aiperf/Dockerfile):
  • Eliminated root-user container execution by creating and switching to a dedicated non-privileged user (benchmark, UID/GID 10001:10001)[cite: 32].
• Kubernetes Infrastructure Security (aiperf/cronjob.yaml):
  • Disabled default ServiceAccount token automounting (automountServiceAccountToken: false) across benchmark workloads[cite: 31].
  • Enforced strict Pod Security Standards by configuring securityContext settings (runAsNonRoot: true, allowPrivilegeEscalation: false, dropping all capabilities, and setting seccompProfile: RuntimeDefault)[cite: 31].

Validation & Testing

• Static Verification: Bash scripts successfully passed syntax checks (bash -n)[cite: 30, 33], and YAML manifests were structurally validated using safe loading techniques.