介绍
Kata Containers 是一个开源社区，致力于使用轻量级虚拟机构建安全的容器运行时，这些虚拟机感觉和执行类似于容器，但使用硬件虚拟化技术作为第二层防御提供更强大的工作负载隔离。
自 2017 年 12 月推出以来，该社区成功地将 Intel Clear Containers 的最佳部分与 Hyper.sh RunV 合并，并进行了扩展，以支持除 x86_64 之外的主要架构，包括 AMD64、ARM、IBM p 系列和 IBM z 系列。 Kata Containers 还支持多种管理程序，包括 QEMU、Cloud-Hypervisor 和 Firecracker，并与 containerd 项目等集成。
架构
https://github.com/kata-containers/kata-containers/tree/main/docs/design/architecture
使用方式
前提：准备一个以containerd为运行时的k8s集群，可根据k8s+containerd部署指引进行部署
参考：https://github.com/kata-containers/kata-containers/blob/main/tools/packaging/kata-deploy/README.md
kubectl apply -f https://raw.githubusercontent.com/kata-containers/kata-containers/main/tools/packaging/kata-deploy/kata-rbac/base/kata-rbac.yaml
kubectl apply -f https://raw.githubusercontent.com/kata-containers/kata-containers/main/tools/packaging/kata-deploy/kata-deploy/base/kata-deploy.yaml
kubectl -n kube-system wait --timeout=10m --for=condition=Ready -l name=kata-deploy pod
kubectl apply -f https://raw.githubusercontent.com/kata-containers/kata-containers/main/tools/packaging/kata-deploy/runtimeclasses/kata-runtimeClasses.yaml
kubectl apply -f - <<EOF
---
kind: RuntimeClass
apiVersion: node.k8s.io/v1beta1
metadata:
name: kata-qemu
handler: kata-qemu
overhead:
podFixed:
memory: "160Mi"
cpu: "250m"
scheduling:
nodeSelector:
katacontainers.io/kata-runtime: "true"
---
kind: RuntimeClass
apiVersion: node.k8s.io/v1beta1
metadata:
name: kata-clh
handler: kata-clh
overhead:
podFixed:
memory: "130Mi"
cpu: "250m"
scheduling:
nodeSelector:
katacontainers.io/kata-runtime: "true"
---
kind: RuntimeClass
apiVersion: node.k8s.io/v1beta1
metadata:
name: kata-fc
handler: kata-fc
overhead:
podFixed:
memory: "130Mi"
cpu: "250m"
scheduling:
nodeSelector:
katacontainers.io/kata-runtime: "true"
EOF
|
验证
kubectl apply -f - <<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: busybox
name: busybox
spec:
replicas: 1
selector:
matchLabels:
app: busybox
template:
metadata:
labels:
app: busybox
spec:
runtimeClassName: kata-qemu
containers:
- image: docker.io/library/busybox:latest
imagePullPolicy: Always
name: busybox
command: ["top"]
restartPolicy: Always
EOF
|
