CRI-O Features for Fun and Profit

Are you a cluster admin looking to be on the cutting edge of Kubernetes features? How about an end-user looking to take full advantage of the capabilities of your cluster? This is the talk for you! Join Sohan Kunkerkar and Peter Hunt as they explore recent features in CRI-O and Kubernetes. They'll cover topics such as native sigstore signature support, running Podman in a Kubernetes pod, using OCI artifacts as a volume, and more. In each, they will highlight potential use cases, pitfalls and common patterns, as well as show how to use each in your cluster. If you're interested in the newest at the intersection of Kubernetes and container runtimes, step right up and learn away!

Transcript

2. CRI-O Features for Fun and Profit Peter Hunt & Sohan Kunkerkar, Red Hat
3. What’s CRI-O? Supports OCI based container images, runtimes, and registries Implementation of the Kubernetes Container Runtime Interface - compliant with the Open Container Initiative Balance stability and features Focus on security Purpose-built for Kubernetes
4. Since 2022, CRI-O has supported verifying signatures of images from sigstore Enforced on image pull and container creation Only node level (all containers on the node must be verified with the same policies) Further Securing Image Pulls ❤
5. Further Securing Image Pulls Example configuration in /etc/containers/policy.json
6. As of CRI-O 1.31.0, CRI-O now supports namespaced verification on a per-namespace basis Further Securing Image Pulls
7. • Historically, CRI-O has been susceptible to sudden shutdown • Image storage corruption • In CRI-O ~1.16, there was code added to cleanup images Unclean Shutdown https://answers.microsoft.com/en-us/windows/forum/all/startup-repair-windows-10/7caf953e-d25a-4814-973c-3029d661d11e
8. • Do you know what is not a corrupted image storage? An empty one! Old Solution: Clear the Storage! https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcT7bD1zwTw1UKUAHJGdcTM525wCB9KBEXCgfQ&s
9. New API in c/storage library to scan image storage Granularity of what is checked available If corruption is found, the corrupted image is removed New Solution: Storage Check/Repair https://i5.walmartimages.com/asr/f45f1fac-29ef-487a-a471-51d068a16e5c.51fafb0189dcac4a1d701fde2abd2db4.jpeg?odnHeight=2000&odnWidth=2000&odnBg=FFFFFF
10. What does it fix?
11. LayerContents? https://github.com/containers/composefs
12. • The runc Challenge: ◦ Recent issue: runc incompatible with Go 1.22. ◦ Root cause: Complex interaction between Go, glibc, and system calls. ◦ Impact: Ecosystem-wide disruption and temporary workarounds. Transitioning to crun as Default Runtime
13. • Written in C, offering efficiency and eliminates Go-specific issues. • Leverages C's mature ecosystem and stable ABI. • Optimized for modern workloads, including edge computing, confidential computing and WebAssembly. • Already defaults to cgroup v2 • CRI-O community voted to use crun as the new default runtime. • For most users, this will not be a breaking change. Transitioning to crun as Default Runtime
14. • crun can be twice as fast as runc for container creation. • Memory usage: crun (3752 KB) vs runc (15120 KB) • crun binary size (~500 KB) vs runc (~14 MB) • Resource efficiency: ◦ Can run containers with lower memory limits ◦ Supports running with a single PID, unlike runc (requires min 5). • Use cases: ◦ Ideal for edge computing and IoT due to low resource consumption ◦ Better suited for high-density container deployments crun vs runc - Performance & Resource Usage
15. • Comprehensive CI Coverage for crun in CRI-O. • Periodic Job to test upstream node e2e test-suite to ensure Kubernetes compliance and stability. CI coverage
16. KEP 4639 - Image Volume Source
17. • New Alpha feature in Kubernetes v1.31. • Allows using OCI images as native volume sources. • Supports AI/ML use cases and extends Kubernetes capabilities. • Enables mounting OCI objects directly into pods. KEP 4639- Image Volume Source
18. • Use Cases: ◦ Sharing configuration files across containers. ◦ Mounting ML model weights alongside model servers. ◦ Separating malware signatures from scanner software. • Key Features: ◦ Reuses existing container image pull mechanisms. ◦ Supports various pull policies (Always, Never, IfNotPresent). ◦ Integrates with existing secret management for image pulling. • Limitations: ◦ Sub-path mounts not supported. ◦ fsGroupChangePolicy has no effect. Image Volume Source
19. https://asciinema.org/a/VOn3FUzrvy3w4ViDIqn2amwBa Demo
20. Future work Explore and contribute to CRI-O's feature roadmap: https://github.com/orgs/cri-o/projects/1 Upcoming Highlights: • WASM plugins loaded directly into CRI-O (Instead of NRI) • Handle WASM workloads as container images • Lazy pull image use case
21. Reach out to us Github Slack
22. Thanks!