Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add Kata Containers support to CRI-O runtime #6830

Merged
merged 5 commits into from
Oct 23, 2020
Merged

Add Kata Containers support to CRI-O runtime #6830

merged 5 commits into from
Oct 23, 2020

Conversation

electrocucaracha
Copy link
Contributor

What type of PR is this?

Uncomment only one /kind <> line, hit enter to put that in a new line, and remove leading whitespaces from that line:

/kind api-change
/kind bug
/kind cleanup
/kind design
/kind documentation
/kind failing-test

/kind feature

/kind flake

What this PR does / why we need it:
This change enables Kata Containers runtime for CRI-O container manager. Kata Containers is an OCI runtime where containers are run inside lightweight VMs resulting in an extra security layer.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:
This change requires to setup the following variables:

container_manager: crio
kata_containers_enabled: true

Does this PR introduce a user-facing change?:

NONE

@k8s-ci-robot k8s-ci-robot added kind/feature Categorizes issue or PR as related to a new feature. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Oct 15, 2020
@k8s-ci-robot
Copy link
Contributor

Hi @electrocucaracha. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@k8s-ci-robot k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Oct 15, 2020
@floryut
Copy link
Member

floryut commented Oct 16, 2020

/ok-to-test

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Oct 16, 2020
@pasqualet
Copy link
Contributor

You are setting the firecracker runtime in CRIO even if it is not created the RuntimeClass. It's not an issue, we just have to add the other RuntimeClass to make it works out of box in another PR.

@k8s-ci-robot
Copy link
Contributor

@pasqualet: changing LGTM is restricted to collaborators

In response to this:

/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@electrocucaracha
Copy link
Contributor Author

You are setting the firecracker runtime in CRIO even if it is not created the RuntimeClass. It's not an issue, we just have to add the other RuntimeClass to make it works out of box in another PR.

@pasqualet you're right, adding firecracker as Runtimeclass will affect the configuration file of containerd as well right?

@electrocucaracha
Enable Kata Containers for CRI-O runtime
190e952 
Kata Containers is an OCI runtime where containers are run inside
lightweight VMs. This runtime has been enabled for containerd runtime
thru the kata_containers_enabled variable. This change enables Kata
Containers to CRI-O container runtime.

Signed-off-by: Victor Morales <[email protected]>
@pasqualet
Copy link
Contributor

pasqualet commented Oct 18, 2020 •
edited
Loading

You are setting the firecracker runtime in CRIO even if it is not created the RuntimeClass. It's not an issue, we just have to add the other RuntimeClass to make it works out of box in another PR.

@pasqualet you're right, adding firecracker as Runtimeclass will affect the configuration file of containerd as well right?

@electrocucaracha containerd is not configured to use firecracker and it will fail if the RuntimeClass is created and used with containerd. Anyway I forgot that firecracker is not configured also in the kata-containers, so we have to configure also in there.
Do you need firecracker or is just a nice to have? I'll work on it as soon I can.

@electrocucaracha
Copy link
Contributor Author

You are setting the firecracker runtime in CRIO even if it is not created the RuntimeClass. It's not an issue, we just have to add the other RuntimeClass to make it works out of box in another PR.

@pasqualet you're right, adding firecracker as Runtimeclass will affect the configuration file of containerd as well right?

@electrocucaracha containerd is not configured to use firecracker and it will fail if the RuntimeClass is created and used with containerd. Anyway I forgot that firecracker is not configured also in the kata-containers, so we have to configure also in there.
Do you need firecracker or is just a nice to have? I'll work on it as soon I can.

I tried to enable it but that requires more than I was expecting so I decided to change this patch to only support kata-qemu

@Miouge1
Copy link
Contributor

Miouge1 commented Oct 21, 2020

Neat!

/approve

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: electrocucaracha, Miouge1

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 21, 2020
@hafe
Copy link
Contributor

hafe commented Oct 23, 2020

Where/how are kata containers installed?
It is not part of this change

@floryut
Copy link
Member

floryut commented Oct 23, 2020

Where/how are kata containers installed?
It is not part of this change

This was done in #6256

@LuckySB
Copy link
Contributor

LuckySB commented Oct 23, 2020

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Oct 23, 2020
@k8s-ci-robot k8s-ci-robot merged commit e03e3c4 into kubernetes-sigs:master Oct 23, 2020
@electrocucaracha electrocucaracha deleted the support_crio_kata branch October 23, 2020 18:29
@pasqualet pasqualet mentioned this pull request Nov 9, 2020
Closed
6 tasks
@electrocucaracha electrocucaracha mentioned this pull request Nov 10, 2020
Closed
6 tasks
@floryut floryut mentioned this pull request Dec 19, 2020
Closed
LuckySB pushed a commit to southbridgeio/kubespray that referenced this pull request Jan 16, 2021
@electrocucaracha @pasqualet @LuckySB
Add Kata Containers support to CRI-O runtime (kubernetes-sigs#6830)
5bc205e 
* Enable Kata Containers for CRI-O runtime

Kata Containers is an OCI runtime where containers are run inside
lightweight VMs. This runtime has been enabled for containerd runtime
thru the kata_containers_enabled variable. This change enables Kata
Containers to CRI-O container runtime.

Signed-off-by: Victor Morales <[email protected]>

* Set appropiate conmon_cgroup when crio_cgroup_manager is 'cgroupfs'

* Set manage_ns_lifecycle=true when KataContainers is enabed

* Add preinstall check for katacontainers

Signed-off-by: Victor Morales <[email protected]>

Co-authored-by: Pasquale Toscano <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@LuckySB LuckySB LuckySB left review comments

@bozzo bozzo Awaiting requested review from bozzo

@holmsten holmsten Awaiting requested review from holmsten

Assignees

@LuckySB LuckySB

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/feature Categorizes issue or PR as related to a new feature. lgtm "Looks good to me", indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
7 participants
@electrocucaracha @k8s-ci-robot @floryut @pasqualet @Miouge1 @hafe @LuckySB