Open Stack

Hi everyone,

Please see today’s meeting recording here: 
https://zoom.us/rec/share/I__kDmq4z6ioMrttGpoTOX26Eu_aW4N0mxQTK67XTqJYJB-DUDDbI-vu66CPRmjz.do9F4gs1E9Wek0fC

Thanks,

Sunny Cai
Open Infrastructure Foundation
sunny at openstack.org


> On Mar 25, 2021, at 6:01 AM, Ariel Adam <aadam at redhat.com> wrote:
> 
> Hi everyone.
> Following is today's meeting summary:
> 
> Use case #1: K8S CI/CD pipeline with kata containers
> 
> The team is still working to define the goal and scope.
> We should have updates for the next meeting 
> 
> Use case #2: Confidential computing 
> 
> Samuel presented slides
> We got good feedback from RH, IBM and Intel, still pending feedback from AMD
> Discussing the topic of service mesh and encrypted containers - what happens when someone pushes a sidecar into the pod? What happens if that sidecar just prints all the memory to somewhere else :-)...
> Idea would be to encrypt the side car as well, not guaranteeing what’s inside but yes regarding what you are getting
> This does not violate our threat model which is focusing on knowing exactly what we are running
> Christophe discussed the topic of the performance cost of using encrypted memory such as extra disk space - the user should decide if he wants to encrypted everything or only the top layers
> Smauel pointed out that encrypting only the upper layers would not be strong enough - If your workload runs on a fedora and you only encrypted your workload, the fedora could have been hacked and added a bunch of backdoors 
> For IBM the goal is to work with full encryption before talking about sharing
> The SEV also has a number of issues regarding density as it is so maybe the additional sharing would not save much - max 512 VMs
> Note that we are talking about SEV per pod (with a kata VM behind)
> We discussed virtio-fs and DAX and the fact that it can’t work with encrypted memory since you don’t want anything to be shared 
> We want to expand the problem statement and scope not only to fully encrypted images but also signed images 
> 
> Use case #3: Performance isolation (Tao) 
> 
> Working on best practices for the networking path
> Later on will do the same for the IO path 
> The question is what and how to do in the kata code (for now it’s hacks on the side) - they would like to see an open source implementation for this
> 
> Action items:
> 
> Samuel to share his slides
> Tao will share a slide on the next meeting helping understand the interface the performance use case are focusing on 
> 
> 
> Meeting notes:
> 
> https://docs.google.com/document/d/1E3GLCzNgrcigUlgWAZYlgqNTdVwiMwCRTJ0QnJhLZGA/edit# <https://docs.google.com/document/d/1E3GLCzNgrcigUlgWAZYlgqNTdVwiMwCRTJ0QnJhLZGA/edit#>
> 
> Thanks. 
> _______________________________________________
> kata-dev mailing list
> kata-dev at lists.katacontainers.io
> http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.katacontainers.io/pipermail/kata-dev/attachments/20210325/5eb46a03/attachment-0001.html>