Kata containers weekly use cases meeting - 25th March 2021
Hi everyone. Following is today's meeting summary: Use case #1: K8S CI/CD pipeline with kata containers - The team is still working to define the goal and scope. - We should have updates for the next meeting Use case #2: Confidential computing - Samuel presented slides - We got good feedback from RH, IBM and Intel, still pending feedback from AMD - Discussing the topic of service mesh and encrypted containers - what happens when someone pushes a sidecar into the pod? What happens if that sidecar just prints all the memory to somewhere else :-)... - Idea would be to encrypt the side car as well, not guaranteeing what’s inside but yes regarding what you are getting - This does not violate our threat model which is focusing on knowing exactly what we are running - Christophe discussed the topic of the performance cost of using encrypted memory such as extra disk space - the user should decide if he wants to encrypted everything or only the top layers - Smauel pointed out that encrypting only the upper layers would not be strong enough - If your workload runs on a fedora and you only encrypted your workload, the fedora could have been hacked and added a bunch of backdoors - For IBM the goal is to work with full encryption before talking about sharing - The SEV also has a number of issues regarding density as it is so maybe the additional sharing would not save much - max 512 VMs - Note that we are talking about SEV per pod (with a kata VM behind) - We discussed virtio-fs and DAX and the fact that it can’t work with encrypted memory since you don’t want anything to be shared - We want to expand the problem statement and scope not only to fully encrypted images but also signed images Use case #3: Performance isolation (Tao) - Working on best practices for the networking path - Later on will do the same for the IO path - The question is what and how to do in the kata code (for now it’s hacks on the side) - they would like to see an open source implementation for this Action items: - Samuel to share his slides - Tao will share a slide on the next meeting helping understand the interface the performance use case are focusing on *Meeting notes:* https://docs.google.com/document/d/1E3GLCzNgrcigUlgWAZYlgqNTdVwiMwCRTJ0QnJhL... Thanks.
Hi everyone, Please see today’s meeting recording here: https://zoom.us/rec/share/I__kDmq4z6ioMrttGpoTOX26Eu_aW4N0mxQTK67XTqJYJB-DUD... Thanks, Sunny Cai Open Infrastructure Foundation sunny@openstack.org
On Mar 25, 2021, at 6:01 AM, Ariel Adam <aadam@redhat.com> wrote:
Hi everyone. Following is today's meeting summary:
Use case #1: K8S CI/CD pipeline with kata containers
The team is still working to define the goal and scope. We should have updates for the next meeting
Use case #2: Confidential computing
Samuel presented slides We got good feedback from RH, IBM and Intel, still pending feedback from AMD Discussing the topic of service mesh and encrypted containers - what happens when someone pushes a sidecar into the pod? What happens if that sidecar just prints all the memory to somewhere else :-)... Idea would be to encrypt the side car as well, not guaranteeing what’s inside but yes regarding what you are getting This does not violate our threat model which is focusing on knowing exactly what we are running Christophe discussed the topic of the performance cost of using encrypted memory such as extra disk space - the user should decide if he wants to encrypted everything or only the top layers Smauel pointed out that encrypting only the upper layers would not be strong enough - If your workload runs on a fedora and you only encrypted your workload, the fedora could have been hacked and added a bunch of backdoors For IBM the goal is to work with full encryption before talking about sharing The SEV also has a number of issues regarding density as it is so maybe the additional sharing would not save much - max 512 VMs Note that we are talking about SEV per pod (with a kata VM behind) We discussed virtio-fs and DAX and the fact that it can’t work with encrypted memory since you don’t want anything to be shared We want to expand the problem statement and scope not only to fully encrypted images but also signed images
Use case #3: Performance isolation (Tao)
Working on best practices for the networking path Later on will do the same for the IO path The question is what and how to do in the kata code (for now it’s hacks on the side) - they would like to see an open source implementation for this
Action items:
Samuel to share his slides Tao will share a slide on the next meeting helping understand the interface the performance use case are focusing on
Meeting notes:
https://docs.google.com/document/d/1E3GLCzNgrcigUlgWAZYlgqNTdVwiMwCRTJ0QnJhL... <https://docs.google.com/document/d/1E3GLCzNgrcigUlgWAZYlgqNTdVwiMwCRTJ0QnJhLZGA/edit#>
Thanks. _______________________________________________ kata-dev mailing list kata-dev@lists.katacontainers.io http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev
participants (2)
-
Ariel Adam
-
Sunny Cai