Open Stack

Hi everyone.
Following is today's meeting summary:

Use case #1: K8S CI/CD pipeline with kata containers


   -

   The team is still working to define the goal and scope.
   -

   We should have updates for the next meeting


Use case #2: Confidential computing


   -

   Samuel presented slides
   -

   We got good feedback from RH, IBM and Intel, still pending feedback from
   AMD
   -

   Discussing the topic of service mesh and encrypted containers - what
   happens when someone pushes a sidecar into the pod? What happens if that
   sidecar just prints all the memory to somewhere else :-)...
   -

   Idea would be to encrypt the side car as well, not guaranteeing what’s
   inside but yes regarding what you are getting
   -

   This does not violate our threat model which is focusing on knowing
   exactly what we are running
   -

   Christophe discussed the topic of the performance cost of using
   encrypted memory such as extra disk space - the user should decide if he
   wants to encrypted everything or only the top layers
   -

   Smauel pointed out that encrypting only the upper layers would not be
   strong enough - If your workload runs on a fedora and you only encrypted
   your workload, the fedora could have been hacked and added a bunch of
   backdoors
   -

   For IBM the goal is to work with full encryption before talking about
   sharing
   -

   The SEV also has a number of issues regarding density as it is so maybe
   the additional sharing would not save much - max 512 VMs
   -

   Note that we are talking about SEV per pod (with a kata VM behind)
   -

   We discussed virtio-fs and DAX and the fact that it can’t work with
   encrypted memory since you don’t want anything to be shared
   -

   We want to expand the problem statement and scope not only to fully
   encrypted images but also signed images


Use case #3: Performance isolation (Tao)


   -

   Working on best practices for the networking path
   -

   Later on will do the same for the IO path
   -

   The question is what and how to do in the kata code (for now it’s hacks
   on the side) - they would like to see an open source implementation for this


Action items:


   -

   Samuel to share his slides
   -

   Tao will share a slide on the next meeting helping understand the
   interface the performance use case are focusing on



*Meeting notes:*

https://docs.google.com/document/d/1E3GLCzNgrcigUlgWAZYlgqNTdVwiMwCRTJ0QnJhLZGA/edit#

Thanks.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.katacontainers.io/pipermail/kata-dev/attachments/20210325/30ebb6f2/attachment.html>