Open Stack

Hi Ricardo,

A quick but late response,  your questions are mostly related to detailed technique, so I can’t give you a certain answer because some answers from me could be controversial and requires more discussion from more developers in community.
So please take my answer as a reference,  but it may not be final solution.


1)  I believe this came up before, but what are the plans to tie docker or kubernetes container resource definitions/utilization to the specific resources running in QEMU. For example, if in kubernetes we specify that our container needs 2Gib of RAM how are we going to tie it into the Kata configuration. Is that going to work seamlessly with hotplug?  Are there any plans to work with the Kubernetes/Docker communities to make this work seamlessly?

Wei: We have open issue: https://github.com/kata-containers/runtime/issues/400 , and PR work in progress: https://github.com/kata-containers/runtime/pull/580 , we can get resource requirement from container config from bundle, then hotplug resources(ie Memory) to existing VM. This is achievable even without help from docker/K8S communities.

2) Looks like the focus in the upcoming year is to make Kata more stable, scalable, adopted, etc. Part of getting more adoption is to support other Hypervisors, so how soon (priority wise) do you see support for other hypervisors like Hyper-V, and Xen? Which one would be next to support?

Wei: I think it depends. If we have many many users want to run it on Windows, then Hyper-V could be next, same to Xen support. All depend on user/customer requirements.


2)  It looks like there are vulnerabilities that also affect VMs, such as the L1 Terminal Fault (L1TF). In terms of addressing are there any plans for mitigating these besides what the Hypervisors or VM runtimes (KVM, Xen, etc) might provide?

Wei: we have a  Vulnerability Management Team handling volnerabilities report (https://github.com/kata-containers/community/pull/39), anyone can send email to VMT members to report an security issue he/she found. VM/Kernel CVE patches will be back ported periodly, besides we will add more security mechanism(e.g. Namespace, Cgroup, Seccomp etc.) to protect workload and platform.

4) Are there any plans to add support to make easy for cluster operators/server admins to debug the VM?  I mean we can always attach to the serial port but would be nice to have some tools to make it easy to debug.

Wei: A tool is a good idea, here we need your issue or PR! ☺ Recently James(@jodh-intel) add a new feature (opentracing support) for better trace logs for kata-containers, I think it can also help debug whole stack. But anyway, this is a big topic, and will need more works. Also, any suggestion is welcome!

Thanks @Ricardo ,  not sure if this answers a bit of your questions.

Best Regards,

-Wei



发件人: Ricardo Aravena [mailto:raravena80 at gmail.com]
发送时间: 2018年9月3日 7:22
收件人: kata-dev at lists.katacontainers.io
主题: [kata-dev] [AC][Election] Questions


Questions, (some of them came up in my talk at the OSS)

1) I believe this came up before, but what are the plans to tie docker or kubernetes container resource definitions/utilization to the specific resources running in QEMU. For example, if in kubernetes we specify that our container needs 2Gib of RAM how are we going to tie it into the Kata configuration. Is that going to work seamlessly with hotplug?  Are there any plans to work with the Kubernetes/Docker communities to make this work seamlessly?

2) Looks like the focus in the upcoming year is to make Kata more stable, scalable, adopted, etc. Part of getting more adoption is to support other Hypervisors, so how soon (priority wise) do you see support for other hypervisors like Hyper-V, and Xen? Which one would be next to support?

3) It looks like there are vulnerabilities that also affect VMs, such as the L1 Terminal Fault (L1TF). In terms of addressing are there any plans for mitigating these besides what the Hypervisors or VM runtimes (KVM, Xen, etc) might provide?

4) Are there any plans to add support to make easy for cluster operators/server admins to debug the VM?  I mean we can always attach to the serial port but would be nice to have some tools to make it easy to debug.

Thanks!



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.katacontainers.io/pipermail/kata-dev/attachments/20180903/729dcafa/attachment-0001.html>