Kubernetes and Container Runtime Enablers to Advanced Platform Features

Transcript

1. Mikko Ylinen, Cloud Software Architect, Intel Open Source * Other names and brands may be claimed as the property of others.
2. Topics • Overview of Advanced Platform Features • Accelerators in Kubernetes* • Kubernetes Device Plugins • Pods, Sandboxing, RuntimeClass • Kata Containers* • Demo: HW Accelerated OpenSSL* Crypto * Other names and brands may be claimed as the property of others.
3. Overview of Advanced Platform FeaTUres • Memory management: Huge Pages • CPU management: Kubernetes CPU Manager • Node features: Node Feature Discovery • Multiple network interfaces: Multus CNI, SR-IOV CNI • Persistent Storage: PMEM-CSI (Intel® Optane™ DC Persistent Memory) • Hardware Accelerators: Intel Device Plugins (GPU, QAT, FPGA) • Container Runtimes: Sandboxing (Kata Containers*)
4. • Variety of accelerator devices supported • SmartNIC • GPU • FPGA • Other specialized co-processors • Highly optimized hardware for specific tasks • Can provide significant performance gain • Saving CPU cycles for other workloads • Require application support
5. Overview Control Plane Node Kubelet Container Runtime Kernel interfaces drivers, sysfs, cgroups Device Plugin etcd Scheduler API Server Controller Manager Workload Discovery Device Plugin API containers: ... - name: demo-container-1 image: k8s.gcr.io/pause:2.0 resources: limits: gpu.intel.com/i915: 1 * Other names and brands may be claimed as the property of others.
6. • “A Pod is the basic building block of Kubernetes– the smallest and simplest unit in the Kubernetes object model that you create or deploy. A Pod represents a running process on your cluster.” • To improve security, untrusted workloads are sandboxed • Multiple runtimes to implement sandboxing: gVisor*, Nabla, Kata Containers* • In Kubernetes*, sandboxing is done at Pod level • RuntimeClass (beta in 1.14), enables users to select the best runtime for their application * Other names and brands may be claimed as the property of others.
7. The speed of containers, the security of VMs. • Open Source project hosted by OpenStack* Foundation. • Merger of two established projects which both started in 2015 - Hyper.SH runV and Intel® Clear Containers. • Each container/pod isolated by a quick-to-boot and lightweight VM. • QEMU, NEMU, Firecracker (since v1.5) • OCI-compatible runtime - Looks just like a container in Kubernetes*, Docker*, or OpenStack. • Features (a subset) • VM templating, kernel same page merging, PCI device assignment • V1.0 released May 22nd 2018, latest is V1.6 (March 2019) * Other names and brands may be claimed as the property of others.
8. Seamless Integration * Other names and brands may be claimed as the property of others.
9. Using DevicePlugins and RuntimeClass * Other names and brands may be claimed as the property of others.
10. • Intel® QAT provides crypto and compression HW acceleration • Enables fast data processing and CPU offload for many server/cloud workloads • SR-IOV enabled PCIe devices: physical and virtual functions (VF) • Open source drivers, user space library, and collaterals at 01.org
11. * Other names and brands may be claimed as the property of others. *
12. https://asciinema.org/a/2N7wF3c9oeCuB9sFqTNm2gmOr
13. mikko.ylinen@intel.com • katacontainers.io • https://github.com/intel/intel-device-plugins-for-kubernetes • https://github.com/kubernetes-sigs/node-feature-discovery • https://github.com/intel/pmem-CSI • https://01.org/kubernetes • https://01.org/intel-quickassist-technology