Workshop on Kata Containers presented in OpenInfrastructure Summit, Apr-May 2019

1. Tracing the life of a packet using
Kata Containers
Hemanth Nakkina, Solution Architect, Ericsson
Balachandra S Thippaiah, Solution Architect, Ericsson
Purnendu Ghosh, Solution Architect, Ericsson

2. —What are Kata Containers
—Architecture:
—Features
—Networking
—Storage
—Demo#1: Deploying Kata Containers
—Integration with Kubernetes
—Demo#2: Kata with Kubernetes
—Other networking options
Agenda

3. https://etherpad.openstack.org/p/katacontainers_workshop_InfraSummitD
enver
Workshopstep-by-stepinstructions

4. KataContainersandTraditionalContainer

5. —OCI Compliant CRI for Kubernetes
—Secure Containers with work-load isolation
—Combines benefits of containers and VMs
—They are isolated and so secure, faster than VMs
—Can support multiple Hypervisor
—Licensed under Apache 2.0
—Merger of Intel Clear Containers and Hyper runV
—No additional network policy to isolate un-trusted tenants
WhatareKataContainers?

6. Mappingofexistingrun-timeinterfaces
Base image Source: https://software.intel.com/en-us/articles/lightweight-virtualized-containers-for-nfv
Docker
containerd
cri-containerd
k8s
cri-o
runc
runv
cc-runtime
kata-runtime
qemu-lite(vm)
cgroups
libcontainer

7. Architecture(1/2)
Components
• QEMU
• Runtime
• Guest-
Kernel
• Rootfs
• Kata-Agent
• Shim

8. Architecture(2/2)

9. Networking:UsingMAC-VTAP
eth2 MAC-VTAPeth1

10. Storage:9pfsandblock
Host namespace
VM
Guest kernel
virtio-9p
Container
rootfs volumes
Container namespace
Host File
system
Host namespace
VM
Guest kernel
virtio-block| virtio-scsi
Container
rootfs volumes
Container namespace
Block
Device
9pfs Block
cold-plug hot-plug

11. —Installation of Kata
—Configuration
—Container Deployment using different run time
Demo-Part-1

12. IntegrationwithKubernetes
Kubernetes
Containerd
runc kata-runtime
POD-1 POD-2
CRI plugin

13. — Enables selection of container runtime configuration in pod spec
— Create runtime class resources with handler’s name as corresponding CRI configuration
— Pod spec with runtime spec
KubernetesRuntimeclass

14. PacketFlow:Podsonsamehost
Namespace-1
tap0_kata
eth0@if1
Namespace-2
tap0_kata
eth0@if2
192.168.1.9 dev calico1 scope link
192.168.1.10 dev calico2 scope link
calico1@if1 calico2@if2
POD-1
(192.168.1.9)
POD-2
(192.168.1.10)
192.168.1.9 192.168.1.10
mac-vtapmac-vtap
veth-pair
veth-pair

15. PacketFlow:North-Southtraffic
default via 54.39.176.1 dev ens3
calico1@if1
veth-pair
Namespace-1
tap0_kata
eth0@if1
POD-1
(192.168.1.9)
192.168.1.9
mac-vtap
$ ping google.com
ens3

16. PacketFlow:Podsondifferenthost
192.168.2.0/26 via 54.39.176.1 dev ens3 proto bird
calico1@if1
veth-pair
Namespace-1
tap0_kata
eth0@if1
POD-1
(192.168.1.9)
192.168.1.9
mac-vtap
$ ping 192.168.2.9
ens3
192.168.1.0/26 via 54.39.176.2 dev ens3 proto bird
calico1@if1
veth-pair
Namespace-1
tap0_kata
eth0@if1
POD-2
(192.168.2.9)
192.168.2.9
mac-vtap
ens3

17. —Kubernetes installation using kubeadm
—Adding calico as CNI for kubernetes
—Pod-pod networking on same host
—North-south traffic
—Pod-pod networking on different host
Demo#2:KatawithKubernetes

18. Networking(2/4):using OVS-DPDK
eth1 (/tmp/sock0)vhostOVS-DPDK
vf1 vf2 PF

19. Networking(3/4):using SRIOV
ixgbe
driver
SRIOV
vf1 vf2 PF
sriov-plugin QEMU

20. Networking(4/4):UsingTCMirroring
eth2eth1
vhost
-net
tapTC

21. Thanks!