<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi everyone,<div class=""><br class=""></div><div class="">Please see today’s meeting recording here: </div><div class=""><a href="https://zoom.us/rec/share/I__kDmq4z6ioMrttGpoTOX26Eu_aW4N0mxQTK67XTqJYJB-DUDDbI-vu66CPRmjz.do9F4gs1E9Wek0fC" class="">https://zoom.us/rec/share/I__kDmq4z6ioMrttGpoTOX26Eu_aW4N0mxQTK67XTqJYJB-DUDDbI-vu66CPRmjz.do9F4gs1E9Wek0fC</a></div><div class=""><br class=""></div><div class="">Thanks,</div><div class=""><br class=""><div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Sunny Cai<br class="">Open Infrastructure Foundation<br class=""><a href="mailto:sunny@openstack.org" class="">sunny@openstack.org</a><br class=""><br class=""></div>
</div>
<div><br class=""><blockquote type="cite" class=""><div class="">On Mar 25, 2021, at 6:01 AM, Ariel Adam <<a href="mailto:aadam@redhat.com" class="">aadam@redhat.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">Hi everyone.<br class=""><div class="">Following is today's meeting summary:</div><div class=""><br class=""></div><div class=""><span id="gmail-docs-internal-guid-2ac1076d-7fff-47d1-9afc-9718d2bde885" class=""><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="font-family: Arial; background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;" class="">Use case #1: K8S CI/CD pipeline with kata containers</span></div><br class=""><ul style="margin-top:0px;margin-bottom:0px" class=""><li dir="ltr" style="list-style-type: disc; font-family: Arial; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre;" class=""><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap" class="">The team is still working to define the goal and scope.</span></div></li><li dir="ltr" style="list-style-type: disc; font-family: Arial; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre;" class=""><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap" class="">We should have updates for the next meeting </span></div></li></ul><br class=""><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="font-family: Arial; background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;" class="">Use case #2: Confidential computing </span></div><br class=""><ul style="margin-top:0px;margin-bottom:0px" class=""><li dir="ltr" style="list-style-type: disc; font-family: Arial; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre;" class=""><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap" class="">Samuel presented slides</span></div></li><li dir="ltr" style="list-style-type: disc; font-family: Arial; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre;" class=""><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap" class="">We got good feedback from RH, IBM and Intel, still pending feedback from AMD</span></div></li><li dir="ltr" style="list-style-type: disc; font-family: Arial; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre;" class=""><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap" class="">Discussing the topic of service mesh and encrypted containers - what happens when someone pushes a sidecar into the pod? What happens if that sidecar just prints all the memory to somewhere else :-)...</span></div></li><li dir="ltr" style="list-style-type: disc; font-family: Arial; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre;" class=""><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap" class="">Idea would be to encrypt the side car as well, not guaranteeing what’s inside but yes regarding what you are getting</span></div></li><li dir="ltr" style="list-style-type: disc; font-family: Arial; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre;" class=""><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap" class="">This does not violate our threat model which is focusing on knowing exactly what we are running</span></div></li><li dir="ltr" style="list-style-type: disc; font-family: Arial; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre;" class=""><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap" class="">Christophe discussed the topic of the performance cost of using encrypted memory such as extra disk space - the user should decide if he wants to encrypted everything or only the top layers</span></div></li><li dir="ltr" style="list-style-type: disc; font-family: Arial; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre;" class=""><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap" class="">Smauel pointed out that encrypting only the upper layers would not be strong enough - If your workload runs on a fedora and you only encrypted your workload, the fedora could have been hacked and added a bunch of backdoors </span></div></li><li dir="ltr" style="list-style-type: disc; font-family: Arial; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre;" class=""><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap" class="">For IBM the goal is to work with full encryption before talking about sharing</span></div></li><li dir="ltr" style="list-style-type: disc; font-family: Arial; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre;" class=""><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap" class="">The SEV also has a number of issues regarding density as it is so maybe the additional sharing would not save much - max 512 VMs</span></div></li><li dir="ltr" style="list-style-type: disc; font-family: Arial; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre;" class=""><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap" class="">Note that we are talking about SEV per pod (with a kata VM behind)</span></div></li><li dir="ltr" style="list-style-type: disc; font-family: Arial; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre;" class=""><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap" class="">We discussed virtio-fs and DAX and the fact that it can’t work with encrypted memory since you don’t want anything to be shared </span></div></li><li dir="ltr" style="list-style-type: disc; font-family: Arial; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre;" class=""><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap" class="">We want to expand the problem statement and scope not only to fully encrypted images but also signed images </span></div></li></ul><br class=""><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="font-family: Arial; background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;" class="">Use case #3: Performance isolation (Tao) </span></div><br class=""><ul style="margin-top:0px;margin-bottom:0px" class=""><li dir="ltr" style="list-style-type: disc; font-family: Arial; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre;" class=""><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap" class="">Working on best practices for the networking path</span></div></li><li dir="ltr" style="list-style-type: disc; font-family: Arial; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre;" class=""><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap" class="">Later on will do the same for the IO path </span></div></li><li dir="ltr" style="list-style-type: disc; font-family: Arial; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre;" class=""><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap" class="">The question is what and how to do in the kata code (for now it’s hacks on the side) - they would like to see an open source implementation for this</span></div></li></ul><br class=""><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="font-family: Arial; background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre-wrap;" class="">Action items:</span></div><br class=""><ul style="margin-top:0px;margin-bottom:0px" class=""><li dir="ltr" style="list-style-type: disc; font-family: Arial; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre;" class=""><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap" class="">Samuel to share his slides</span></div></li><li dir="ltr" style="list-style-type: disc; font-family: Arial; background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; vertical-align: baseline; white-space: pre;" class=""><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap" class="">Tao will share a slide on the next meeting helping understand the interface the performance use case are focusing on </span></div></li></ul></span></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><b class="">Meeting notes:</b></div><div class=""><br class=""></div><div class=""><a href="https://docs.google.com/document/d/1E3GLCzNgrcigUlgWAZYlgqNTdVwiMwCRTJ0QnJhLZGA/edit#" class="">https://docs.google.com/document/d/1E3GLCzNgrcigUlgWAZYlgqNTdVwiMwCRTJ0QnJhLZGA/edit#</a><br class=""></div><div class=""><br class=""></div><div class="">Thanks. </div></div>
_______________________________________________<br class="">kata-dev mailing list<br class=""><a href="mailto:kata-dev@lists.katacontainers.io" class="">kata-dev@lists.katacontainers.io</a><br class="">http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev<br class=""></div></blockquote></div><br class=""></div></body></html>