Hello Welcome to this video giving an overview of
how Kata Containers are implemented with Kubernetes cluster.
In this video we will be looking at where Kata Containers fits in the Oracle Cloud Native
Environment and how using Kata Containers with Kubernetes enhances your container and
orchestration environment for the delivery of microservices and next-generation application
development. Remember to also look for other videos covering
installation, deployment and management of Kata Containers.
In this video you will learn how Kata containers differentiate from traditional containers.
You will gain a basic understanding of how a Kubernetes cluster works and how Kata containers
works within the cluster to support containerized applications.
You will be able to list the software and packages needed to build an Oracle supported
Kubernetes cluster implementing Kata containers. To support Oracle customers developing microservices
applications, Oracle has created the Oracle Cloud Native Environment.
It encompasses open source Cloud Native Computing Foundation (CNCF) projects supporting open
standards and specifications for deploying microservices applications.
As part of the fundamental infrastructure of deploying cloud applications, Oracle provides
tools to create and provision OCI-Compliant containers.
Oracle has adopted Kata Containers, an Openstack Foundation project, which defines creating
the container in a lightweight virtual machine, which will provide the workload isolation
and security for containers deployed in the container infrastructure.
It combines the benefits of containers and virtual machines.
Kata Containers is OCI (Open Container Initiative) compliant, as are Docker containers.
When creating typical containers, any containers launched within the same VM, will share the
resources of the VM kernel. From a kernel perspective they are not truly
isolated, and the sharing of the same kernel also introduces potential security issues.
In the graphic, on the left you can see how even with separate namespaces, containers
launched within the same VM share the same kernel.
Kata Containers are lightweight container VMs created to provide isolation and a separate
kernel for each container. In the graphic on the right you can see how
each Kata container, with its namespace, is within its own lightweight VM and has its
own kernel. Kata Containers work and perform like typical
containers, but have the resource isolation and security advantages of regular virtual
machines. The lightweight VM used for each container
addresses the security concerns of the shared kernel used by traditional containers.
To support the creation of Kata containers, a Kubernetes cluster is first created to orchestrate
and manage the deployment of containers. The Kubernetes cluster comprises of master
nodes and worker nodes. The master node manages the cluster and schedules
the deployment of container pods, and services. High availability can be created by implementing
multiple master nodes in the cluster. Containers are deployed using what are called
pods on the worker nodes. The pod is a construct in which you can run
a single container or logically group multiple containers together.
Instead of accessing containers directly, another function called a service is created
which provides access to pods and their containers. Various types of services can be created to
allow internal and external communication to pods.
With Kata containers, separate lightweight VMs are created for each container in a pod,
and with each of these lightweight VMs having its own separate VM kernel.
For more information about Kubernetes, its architecture, and building the cluster, look
to the Oracle Learning Library where you can find more videos on these topics.
Oracle Kata Containers are implemented by integrating with an Oracle Container Services
for use with Kubernetes cluster to launch and deploy the containers in Kata virtual
machines. The Kubernetes cluster is built with with
a minimum of Oracle Linux 7 update 5 and Unbreakable Enterprise Kernel release 5.
In the Kubernetes cluster you build the master and worker nodes using the Oracle Container
Services for use with Kubernetes tools. To launch containers from the Kubernetes cluster
you must also register with the Oracle Container Registry, and on each node, log in to the
registry through Docker. Oracle Container Runtime for Docker is installed
and used in the cluster for building and containerizing applications, but as you will see, for the
Oracle implementation of Kata containers, it is not used for pulling container images
to be run in the Kata container VMs. With the Kubernetes cluster built, the worker
nodes are then updated to support the creation of Kata container VMs.
For this, Oracle Container Runtime for Kata, QEMU and CRI-O packages are installed to the
worker nodes. QEMU virtualization is used to allow the Kata
virtual machines access to worker node CPU and other resources.
CRI-O allows you to run containers directly from Kubernetes when launching a new pod.
CRI-O is an implementation of the Kubernetes CRI (Container Runtime Interface) to enable
using OCI (Open Container Initiative) compatible runtimes.
It is a lightweight alternative to using Docker as the runtime for Kubernetes.
It can pull OCI container images from any container registry and here it is used as
an alternative to Docker for pulling containers. These containers are then deployed into Kata
container VMs. With all of these components used to build
your Kubernetes cluster, any containers launched through Kubernetes orchestration are created
in Kata container VMs. Oracle provides an extensive number of resources
which you can use to find out more about this subject and others.
For further information about Kubernetes and CRI-O, you can visit their Open Source Project
sites at the links shown here. Extensive training videos, content and solutions
covering Cloud related topics like Kubernetes as well as administrative and advanced subjects
for Oracle Linux can be found in the Linux Learning Subscription and Oracle Linux curriculum
paths. In this video you learned how Kata containers
differentiate from traditional containers. You gained a basic understanding of how a
Kubernetes cluster works and how Kata containers work within the cluster to support containerized
applications. You can now list the software and packages
needed to build an Oracle supported Kubernetes cluster implementing Kata containers.
That's the end of this video, Thanks for watching.