Red Hat OpenShift Commons Briefings 2018 | OpenShift Commons, 26 Jul 2018

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: OpenShift Commons Briefing #138: Intro to Container-Native Virtualization with Stephen Gordon

Description

Guest Speaker: Stephen Gordon (Red Hat)

Container-native Virtualization (CNV) – based on the KubeVirt community project – turns OpenShift into a unified platform where developers can build, modify, and deploy applications residing in both Application Containers as well as Virtual Machines. Using a unified management approach simplifies deployments, allows for better resource utilization, and supports different workloads in a more optimal way.

This session will outline how Container-native virtualization seeks to provide this while using the extensible nature of Kubernetes in a way that provides a developer workflow that is as consistent as possible with the same patterns used for working with application containers.

Join Us for future Briefings here: https://commons.openshift.org#join

A

Hello, everybody and welcome again to another openshift Commons briefing, this time we're going to have a introduction to container native virtualization with Steven Gordon from Red Hat. The nature of this briefing is that it's going to be a presentation that upfront you can ask questions in the chat. They'll be live Q&A at the end and the video will be posted along with the slides on YouTube and on OpenShift comm, slash blog right afterwards. So without further ado, Steven introduce yourself and let's, let's get it going all.

B

Righty so my name is Steven Gordon I'm, a product manager at Red, Hat.

C

Focused on a technology we're calling container native virtualization, which is based on an upstream project, korcula I've been working in the virtualization space at RIT for about eight years previously, I was the programmer for OpenStack computer brat and also I spent a decent number of years. Writing documentation for Red Hat virtualization as well.

C

So this plan alluded to in this presentation, I'm going to give you overview of what container native virtualization is and also a short demo, where I poke it on a running openshift system. Just to give you a bit of an idea of how we're fitting virtual machines into kubernetes constructs here.

C

The disclaimer that applies, so we are actively building this technology. There will be a preview in an upcoming OpenShift release. People are also certainly welcome to try out upstream components on shift today or on any kubernetes cluster for that matter, and I'll provide some instruction of how you go about doing that towards the end, but basically just be warned that this is still emerging at this point, although we are very excited about it and certainly welcome discussion and feedback, as we continue to build out the authoring.

C

So in terms of the level setting, I usually like to talk about the story so far virtual machines in a containerized world, so we think about a section of virtualization and containers. Thus, the primary place where those two technologies have come together is when folks need a place to install, run and manage the kubernetes clusters. So we take think about our typical organization. You know: we've built up a lot of experience over the last 10 to 15 years, plus in managing virtual machines.

C

So if I'm a developer or someone who just wants to try out technologies like kubernetes and doctor and OpenShift for the first time, the easiest way for me to get compute resources more often than not is for me to go and grab virtual machines from either an OpenStack or a VMware or even a public cloud environment where all those things are typically going to serve you up virtual machines and that provides a good place to get started running at first container clusters.

C

The other use case we've seen a lot of discussion about for containers and virtualization is around I, already have an application container, but I'm concerned about providing strict isolation for those containers using hardware virtualization technology, and that is what the cotta containers and G+ projects allows. We're concerned with so they're saying if you have an application container, and you want strict isolation for that, we can help. That is not the problem space we are aiming at with container native virtualization and Cubert. What we're thinking about is what about existing workloads.

C

So, as we see this trend in the industry towards container platforms like open shift where kubernetes is becoming the standard way of orchestrating and managing new applications, we're creating the question arises: what to do with the many virtualized workloads that are out there and already exists and I'm really going anywhere fast for business and technical reasons. So from a business perspective, it doesn't necessarily make sense to containerize every worker, that's out there overnight, but also from a technical perspective.

C

Now often my applications have my existing applications has strict dependencies on different operating systems or even older versions. The colonel, if we're talking about Linux operating systems or potentially different K mods, that I need installed for my application to work. All those things are things that I may want from my application, but don't necessarily want from my post system in a containerized environment where I'm sharing a kernel and when we're thinking about this, there are existing solutions that start attempting to converge, containers and virtualization, but typically they force us to still manage them relatively separately.

C

The thinking behind container native virtualization and cube mode is about. How can we bring these tools closer together to offer more of a consistent experience, regardless of whether I'm, interacting and managed interacting with and managing the application there's in a container or in a virtual machine?

C

The container native virtualization enables sorry intends to deliver this by enabling openshift to run virtual machines side-by-side with application containers in a common shared environment. So we want to make it as easy and as seamless to add a virtual machine to earth or shift project as it is to add an application container, so that means making them available directly from the Service Catalog and also, of course, via the CLI constructs. Now we shall demonstrate later it does leverage currently the existing investments we've made in KVM in particular.

C

So we gain all the knowledge we've built up in Kittanning, the KB m2m you and with the projects over the years in building the Linux hypervisor stack. What we're effectively doing is leveraging the fact that we have KVM plugged into the hosts kernel, but we're taking the user space, which effectively represents the virtual machine and putting that in application container. Just like we get containerized any other Linux process that we happen to have.

C

As I mentioned, we are planning to offer technology preview access in an upcoming release of button ships, but you can also certainly try it out with the upstream bits using, for example, openness. Your origin is actually what I'll be using for yeah. Surely.

C

When we bring virtual machines into this environment, we of course benefit from the fact that we can share placement and scheduling logic, network security, isolation, quotas and so on with with kubernetes and the benefit of this.

C

When we start thinking about the types of applications we can build is we are imagining that, in the future we'll see more and more complex applications that are comprised both the newly written application container and existing business functions contained in virtual machines that make up this one one unit of work effectively or one complex application that we're all cost reading, so the ability to treat those the same way and use the shared constructs with kubernetes to manage them. It's a very powerful thing.

C

So what is Cupid the upstream Cubert project, which you can find at Q vertical I/o, that's listed on the slide here. So Qbert is a custom resource definition. Look the folks who aren't familiar with it. Custom resource definitions are a way of extending the kubernetes api to add new objects at a top level in a nicely pluggable way it when I was originally being defined, was referred to if I remember correctly, as third-party resources. The custom resource definition is the final term. That's used in the API as we define these.

C

So the idea is, if I implement a custom resource definition for my object. I can effectively drop it onto an existing kubernetes cluster just by running a manifest against it, and then I can extend the API to represent a new object, so in this particular case with Cubert we're adding a number of objects.

C

Actually, so we have a concept of the virtual machine itself, which is the virtual machine definition, and then we have a concept of the virtual machine instance, which is an actual running virtual machine and I'll talk a little bit more about that context of the demo, so that, hopefully, will make more sense.

C

The intent in doing this is to take as kubernetes native and approach as possible to bring virtualization into the indoor so that it doesn't feel like it's a second-class citizen, but rather than a virtual machine in the first class object that you can interact with in the same way as anything else in the system, and this also means we can leverage constructs like The, Container, networking, interface, container storage interface and other kubernetes native integrations, so that we can share.

C

For example, the pod networking constructs and have VM and an application container plugged into the same network. If we so desire and as illustrated on the right there. Of course, we also have the ability to schedule and run both the ends and application containers side by side, because ultimately, these are still representative pods. From a Cooper days, scheduling point of view.

C

The Cupit top-level organization on github includes the bulk of the components of container native virtualization.

C

There are others that are worth mentioning, so in particular, we have the container race data recorder data importer, depending on your persuasion, which is a somewhat independent project and at providing a way to easily import images in various formats to a kubernetes the system volume so in particular for virtualization, we're primarily concerned about being able to ingest the many qk2 and roar and so on images that exist out there on the internet for things like fedora, but also for other purposes.

C

Yours, you have a variety of other file formats that it can ingest and write to a PV as well. If that's something you find it useful for your application containers as well. We also have a number of extensions to the authorship web console we're working on both in terms of being able to generically represent C IDs in the UI, but also specific to virtual machines. There are some things we would like to represent in the UI, so you can imagine.

C

A virtual machine has some actions that don't necessarily apply to a pod, like various things around the power state, for example, that we still want to provide a mechanism for how someone could get to that using the UI without having to jump out to the CLI. And finally, we also have done some work or making bird v2v available as an answerable playbook bundle.

C

So what that V to be does enable us to bring in a virtual machine from an existing virtualization platform like VMware vCenter and run that on a KVM hypervisor in this case using kinetic virtualization.

C

So in terms of the anatomy of cupid itself at a very high level, poke a few of these pods when I get to the demo. So we define over on the Left, we have our user, who is interacting at the API level, with the custom resource to make a request. It might be the virtual machine customer resource, for example.

C

In this case, we then in turn have a vert controller, which is the controller for the CID and does a lot of the work for a control plan perspective which is handing off to a vert Handler and the VM itself, and the VM itself, as I mentioned earlier, is really the same qme process that we would have run traditionally on reddit, virtualization or readout. Instead of.

B

C

But that qme process is now itself in an application container, which is in a pod running on the broken shift. Minion.

C

So, in terms of the reason we have the c ID so, as I alluded to in the conversation at the UI, those machines have their own. There is common parameters and actions that maybe we need to be able to perform on them, and traditionally we have used the lizard as a way of expose those notes. The various systems- and you can see some examples on the right in terms of the virtual machine object. So here we have a virtual machine domain.

C

It has a number of devices attached to it, has some resource requests and then it has some networking requests as well, so we're creating this top-level api object to represent a virtual machine specifically, which ultimately gets translated by the cube of components into something that can actually be scheduled and run as a pod.

C

By implementing this is a cid. We do benefit from inheriting a lot of things from communities itself around authorization, real, so storage and networking, as I mentioned before.

C

Ultimately, the aim is that we can run application containers and virtual machines side-by-side. On the same token, if nodes and sharing resources- and that is what we're enabling are using container date- virtualization- we do have- it also have some integrations that allow us to use something called live cinder to access existing storage solutions from the OpenStack ecosystem as well.

C

So this is not about running OpenStack, so much as allowing us to plug the OpenStack block device drivers directly into oppression and kubernetes, using a container storage interface, which is something we're actively working on, and the reason that's important is that if we think about virtual machines, one of the things they typically benefit from from a storage perspectives that don't necessarily applies much to application containers, is they heavily use cloning? Our storage assisted cloning, where it's available to do things like making cloning from a template or taking snapshots and the entry volume drivers.

C

The companies don't support this there. It is intended that cloning can be exposed through the CSI spec when it becomes available, but the OpenStack ecosystem gives us a ready-made selection of drivers that we could plug directly into CSI. That already have cloning support for the most part. We do also have UVO, though, the ability to fall back on host assisted cloning where necessary or where it's on a bail, so in terms of just walking through a quick example use case before I jump to the demo. So, of course you know.

C

Example, we need to start with a VM, so I have an existing VM in my organization that performs some business function that I care about. It's exposing a service or API I can import that virtual machine from where it already exists, either using b2b or from an image I might happen to have so, for example, have a cute cartoon image exporter from my existing system. I can then share desire once I've imported it to contain a native virtualization start building application containers around that service.

C

That virtual machine is exposing, and this is easily done using the same pipelines that we're normally using like your ships, so we're able to start building on the same platform. Our new and richer business functions around that existing one, but also if the return on investment starts making sense to me to actually decompose that application. Now that I've got everything running on the open platform, I can also easily start paring out pieces of that virtual machine in place effectively and taking those out into application containers. Those switch screens now and with a bit of luck.

C

I still have a running.

C

Mini shift instance, let's just check on that.

C

All right, we do indeed so I'm, just using a mini shift. 310 CD of open ships, it's the origin one and, as you can see, I also have the reliance installed as well. So the first thing I think I can do it's just check so I'm doing here, so Cuba could to cuddle and get custom resource definitions.

C

So you can see here that the ownership web console has behind one for itself, but you can also see that my cuban installation has added a number of custom resource definitions as well, so the first of those virtual machine instance presets. This object type refers to what we call presets.

C

These are very similar to what you would think of as flavors or instance, types if you're familiar with Amazon or stack or other existing virtualization solutions and I'll actually have cement some presets in my virtual machine that in a second we also have virtual machine instance replica sets, as the name implies. Allow me to have virtual machines in my replica sets and then I have this concept of the virtual machines, which is the static definition and also the virtual machine instances and the reason.

C

Those are two separate objects, if you think about pods, typically for the pod lifecycle, once I terminate it, it's gone forever. If I wanted to when I get it back, I create a completely new pod, different identity for virtual machines. We tend to care a little more about the state and identity of the virtual machine for better or worse.

C

So if we want to facilitate bringing in an existing traditional virtual machine, we need to have some representation of the virtual machine and it's powered off state and that's where the virtual machine object comes in when I then instantiate that virtual machine definition I get what's called a virtual machine instance, which is the actual running virtual machine and we'll see how that works.

C

By virtue of having the custom resources on the system, I can do things like get VM eyes and I see you get the ends as well. Now, of course, these haven't found anything yet because I haven't created.

C

So if I have a look around here, I've pre created a definition for a simple service VM.

C

Let's have a look at that, so not surprisingly, I get my VM a name we'll see here. So fine virtual machine is, of course, the virtual machine object very effective and we've specifically using the d'hubert API version. Information I will so further down here. I have a number of labels. The guest one doesn't matter too much. Cubert /size is an interesting one, so this label is effectively telling give it to try and match this to a preset.

C

If my name is this and what you'll see in this particular llamó clause, I actually define a preset at the end as well. I have eliminator here, decided, I'm, defining a different object, refute again using the cupid API console version, constructs and I'm, creating a virtual machine instance preset in this case I'm, calling it small I'm putting it in the qubit that I slash size, labeling space, match labels and you'll see here. The only thing this preset this particular preset is binding. Is the memory size for the VM?

C

You could also define things like CPU or even specific climate lags, and things like that. So we have a different preset, for example, with wire to run a Windows gift. Windows. Guess typically expect some specific things. Great thing about presets is that we have the ability to provide some out-of-the-box for things like windows. So you don't have to worry about the specific notes at all, but also that an operator or a user can define presets that they want to use for all their VMs.

C

So they can basically avoid having to specify all the information every single VM request. So going back to my at the end, definition I have to find two discs on this particular one. So in this case, because it's a serous image and relatively small I'm, just using a registry disk where I'm pulling an image straight from a docker registry, I can also, as I mentioned, use the common data import to import a disk image to DV.

C

That's another option as well and I'm also defining a cloud in a disk, so the cloud unit disk maps to a volume which I actually define inline, but for those familiar with the cloud in it. It's a way of good strapping, a virtual machine with some data that can be used during setup and then the cloudiness scripts that runs within the virtual machine I can use that information to do some additional networking or user setup should I so desire.

C

So we here we define in the volumes the basically these map to the discs. Above so I have my registry volume, which is pulling the serious tear-offs registry disk demo out of the Cuban airspace, and then my clarinet volume is effectively defining line. So this is just some basics. Before user data I can in the current version, is actually not even basically or uncoated. I can just include your game line by so it shoots. So let's go and actually execute that Gemmell.

C

You notice, I'm, jumping back and forth between cue cattle and I, see here basically I'm doing that. Just to show that you can there's really no difference which one it is both OC.

A

C

A

C

Of their ability to understand, see IDs and worthless them just as well as any other natives doing Eddy's object in a create my example, so it creates both the VM itself and it creates a virtual machine instance preset well now, I could, if I wanted to create more VMs based on that preset I could do that. I, don't need to redefine it every time.

C

Obviously, so, if I do my OC get the ends, I now have a cirrus fan now, because I have because I didn't include a running state in at the end definition I will not yet have the mi, so I have the ability, though, so if I you go see edit BMI BMI resource VM and then I can go down to the spec and go running false rang.

C

True with that, it will quickly start the effectively acting as a controller ago, as you get the Mis now I should have show us the end coming up and describe. It should be able to see whether it's scheduled or not. We can see that miss scheduling it's already in the running state.

C

So now I can do some things with my VM, so we also have a helper script for that cuddle at the moment. It does also act as a cute cuddly bugging, but it's actually easier to use that cuddle directly for me, but first of all, I'm going to show it console access to us VM, so I've already got access to my VM and I can log in as the CSU, the Coast Guard and my.

A

Whole system here.

C

Was the main shift I said can see the serious information? Sorry I said that meaning she died, so I mean the central swine in this particular case. So here you can see I'm running a different operating system. Yes, I can then exit the console using the break command.

C

My backup, all the other thing I can do so I also viable cut I'll have the ability to get a BNC connection, it's more useful for obviously a graphical guess, but basically the same thing and it's people a case, but I have a graphical display.

C

So the other things so the other thing I should mention it, sir. That cuddle also includes start and stop actions so before just to demonstrate the way their control works. I went in directly edited the ammo to set the running status. True, I can also just cuddle start, stop action and we'll see sorry I remember to provide the VM name.

C

Good, stop once es VM I also get EMI is, should almost instantly, maybe not I'm. Taking second moment, let's have a look at the definition here.

C

There we go so it has actually deleted. It just took the second that okay, so of course, my original, the end definition is still there. It's just that now, when I go to edit it, it will show that VM is now running false definition.

C

So I'm looking running for what exactly the other things, obviously I stop it here. So let's started again I'm sure happening also quickly. If I do a little get odds in cube system, namespace will actually see the API for the CID is running.

A

C

Two pods: they behave in an active/passive fashion, same thing with the controller and then finally, we have this handler pod, which is what is actually handing on to the VM launch and then, in my view, code or get pods. My local namespace I will see the actual launcher, which is where um you and the guest itself is actually running.

C

So all of the so an administrator enables Cupidon to the cluster and a native virtualization for the cluster, but then, as a user I'm able to watch the answer in my own neck space. That concludes the demo. From my point of view and I've seen notifications bouncing up and down into a chat, so I'm just going to switch back with blue jeans and see what, when I talk about.

A

Yeah there's a question in here from Aaron about struggling with why Wade would want to run a VM with within a pod. You know sort of the opposite direction of reach, then going so maybe you could add some color to that. Yeah.

B

So what we're seeing is a gradual trend towards done and getting more.

C

Operator inquiries about running open ship classes on bare metal because for my application containers themselves, so the things that I've already deconstructed or written from scratch and application containers there's not really any concrete need for the virtualization layer, but I still have existing virtualize a virtualized workloads. They want to be able to bring with me as I go through that transition and that's what cnv is trying to enable. So, yes, I can certainly run kubernetes and open ship clusters on machines today.

C

But where we're seeing a lot of interests that particularly only think about some of the features we're seeing introduced to communities around more performance, sensitive features like access to GPUs, the virtualization layer is not adding a heap for those these cases. In fact, it's adding complexity, if anything so CNB is aimed at assisting the people who want to run clusters on bare metal but bring some of their existing virtual machines with them as part of a complex application.

A

Aaron did that answer your question by unmute you and let you follow up with you. Have.

A

Yep, okay, he's he's settled there so um Steven do you have a screen that you can go back to that? Has the resources where people can connect with you and find out more information that.

C

Is an excellent point: yes, I did have a couple of other slides, so, first of all terms of the demo, you couldn't run so if you go to cuba that, on the landing page you'll get a link to this, but also you go to the flash, get underscore pew good. There instructions there for showing you how to quickly run this up on mini shift, mini q, OS c cluster up, basically anything you can get your hands on fairly easily terms of future plans.

C

We do have a lot of stuff planned around writing operators, role to keep it components themselves, adding support for additional vm lifecycle options, adding networking options which will also improve things that are available for application containers, so things like writing, host device, plugins glad to networking and srap, adding more flows to the user interface.

C

Turnkey storage solution support, so I mentioned lips in this stuff in particular, and also the ability to tie virtual machines into concepts like them and sets jobs. This duo mastered meshes. That's all now in terms of collaboration. We are not currently seeking design partners in Elliot Delta's. Keep the ties, give us feedback.

C

Even if you're just trying it out on cluster at one where it's just any other thoughts on what the workflow is like what you liked, what you didn't like and it comes of communication, we have Akito.

C

Organization, we have a Google group called Cuba dev and we also are on IRC and hash Beaufort channel on SEO free no net. Do you want to reach out to me directly I'm also available at escort at Red, Hat, calm or on Twitter as excess Gordon, and basically feel free to contact us and I'm also actually happy to take questions in general on the intersection of communities and virtualization? So that's specific, very interesting space. So.

A

In terms of kubernetes work, things and working groups is: is there one in particular that you guys are taken? Yes,.

B

C

There is a working group and the channel on the kubernetes slack is hash. Virtualization recall correctly. That's working group across a number of the projects I mentioned that have interests around the intersection of humanities and visualization. So, even though the use cases are different, that's an area where we're collaborating with cotta containers and key visor folks, for example- and we have a face-to-face meeting at the last, keep going in Europe. We could have one last year in Austin and I. Think we'll probably have one again in Seattle folks might say that.

A

That would be great because I I know bukhan is coming up, that North America and Seattle on December 11th through 13th and we're gonna have another Oklahomans gathering on December 10th, so we'll definitely have to figure out how to get a feeder of birds of a feather or one of the deep dive sessions set up for you guys. So you can connect with people at VidCon America that was great yep sure find some space, so everybody can actually see each other face-to-face.

A

That would be great, though I'm, not seeing any other questions in the chat, so I'm going to give you a few seconds to pop in a question or not otherwise, reach out to Steve and we'll we'll try and get you connected. You can also connect with folks on the open ship common slack channel. If you haven't joined openshift Collins, yet you can do so so at comments got openshift org and we'll get you into slack channel and then you can reach out to people and talk with your peers there on all kinds of different topics.

A

So thanks again Steven for taking the time today and that we really appreciate it and we're looking forward to you bringing some of your early adopters back to talk about lessons learned and showcase, how you've incorporated their feedback. So.

B

Thank you yep sure. Thank you all for your time.