Andrew Wilkinson Add table of contributors
Andrew Wilkinson Add use case template
There have been security concerns when deploying untrusted workloads using bare-metal containers, which utilize shared kernel from the host and only use cgroups and namespaces for isolation. Kata Containers addresses these concerns by using HW virtualization to isolate each container.
...
Use case: uCPE Edge Computing
Attributes | Description |
Type | New |
Industry Sector | Edge, Cloud, Enterprise, Telco |
Business driver | There have been security concerns when deploying untrusted workloads using bare-metal containers, which utilize shared kernel from the host and only use cgroups and namespaces for isolation. Kata Containers addresses these concerns by using a lightweight VM to isolate each container. This additional security layer would allow the support of multiple tenant container workloads in one bare-metal Kubernetes cluster. |
Business use cases | Kata Containers will add hard multi-tenancy capabilities. By adding Kata Containers and containerd into ICN, a Kubernetes cluster would be able to launch containers using both runtimes: runc for trusted workloads and Kata Containers for untrusted workloads. A telecommunications provider deploys CNFs such as SD-EWAN and NGFW under a Kubernetes Cluster in an Edge Location. The provider would like to deploy its trusted workloads using runc. A Customer of the provider deploys normal applications in the same Kubernetes cluster. Even with customer, there could be multiple departments deploying different workloads which would need isolation. For these different workloads, provider could allow to run them using Kata Containers in the same Kubernetes cluster. Using EMCO, which provides multitenancy capabilities, provider could define edge locations where Kata Containers is available and will use EMCO to redirect and isolate with respect to logical clouds and users. |
Business Cost - Initial Build Cost Target Objective | Kata Containers should be able to run in existing infrastructure as long as it has hardware virtualization enabled. No additional cost from current ICN infrastructure. |
Business Cost – Target Operational Objective | Same as ICN. |
Security need | Kata Containers runs a lightweight VM, a minimal Kernel and a rootfs for launching containers. This provides more isolation against attacks from one untrusted container to other trusted/untrusted containers or to the host. This solution will allow the support of multiple tenant container workloads in a single bare-metal Kubernetes cluster. |
Regulations | |
Other restrictions | |
Additional details | Kubernetes RuntimeClass (from k8s v1.14) and PodOverhead (from k8s ) are features that allow Kata Containers to be selected, managed and monitored with existing Kubernetes tools. |
Presentation:
| View file | ||||
|---|---|---|---|---|
|