Red Hat OpenShift Sandboxed Containers | Red Hat OpenShift, 17 Mar 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Red Hat OpenShift Sandboxed Containers Operator

Description

Learn how to install the Red Hat OpenShift sandboxed containers operator on top of Red Hat OpenShift.

Red Hat OpenShift sandboxed containers is an OCI-compliant container runtime, which lets you run your container workloads in lightweight virtual machines to provide increased isolation. This reinforces the "defense in depth" strategy in case, for example, of container escape.

Learn more: https://www.redhat.com/en/openshift-sandboxed-containers

A

Hello today, I'm going to show you how to install the openshift sandbox containers operator on top of openshifts and container platform version 4.10.

A

So I'm logged as administrator in the openshift console and I'm going to click on the operator hub. Let me type sandbox in the list filter and then I have the openshift sandbox containers operator. I click on that and I see a description of that operator.

A

It's based on the kerala containers, open source project and it provides an oci compliant runtime to run your workloads inside lightweight virtual machines, so they have their own isolated kernel and that adds an additional layer of isolation.

A

There is additional documentation at the bottom of the page that describes the values concepts.

A

In particular, a sandbox in a sandboxed container's environment corresponds to a part in openshift.

A

So, let's install the operator, we have to select the update channel, the installation will always happen in a namespace and that namespace has to be openshift sandbox containers operator and the update approval should be automatic.

A

So we just click on install.

A

And, as you can see, the installation is relatively quick.

A

So now our operator is installed and ready for use.

A

In order to trigger the operator, we need to create an instance of a catalog configuration.

A

So we click on create color, config.

A

And I'm going to use the name demo config.

A

There is a config pool, selector that you can use if you want to specify the machines that so the nodes that should uh host your sandbox containers. In my case, I'm going to leave that, as is which selects other nodes on my cluster.

A

Now I click on create and my color config is created and applied.

A

We can now watch our operator doing its work by clicking on this yaml tab and we are going to see that the operator is in progress and a list of the nodes where the operator is currently installing the required binaries we're going to shift to a terminal in order to be able to see what is happening in this other terminal window.

A

I'm going to watch the output of my democala config, so we see that it's still in progress and now since the installation is going to take a while, we are going to fast forward through time.

A

Right now it's installing in worker 2 and that's the bottom window in that other terminal window. So we are going to watch that installation progress and then the welcome node is going to reboot.

A

You can check the time it really takes, but looking at the clock at the top right. So now our worker node is going to reboot and that's the usual linux boot. The reason we need to reboot the node is because uh we are going to install a version of qmu that is optimized for this use case called qmu kiwi and that's going to. Let us run our virtual machines so doing this. Software installation on red hat calls requires a reboot.

A

This is also the reason why we are updating one node at a time in order to preserve the cluster. You can do things in parallel, but then you are going to make your cluster less available for other workloads. Why this happens?

A

So we are now done with worker 2 and the operator is going to add this to the completed worker, completed node list and start the installation now on worker zero.

A

Installing on worker, zero works exactly like for worker two, so we're going to fast forward through this until the point where this is marked as completed and the operator shifts to the last worker in my cluster worker one. So we are going to see that appear to the in progress list and again, let's fast forward.

A

So now the last node is rebooting and we are going to see that once the binaries have been installed on all workers and they are all marked as completed the operator- is going to install a runtime class called cada. So this is done now and my cluster is now ready to run sandbox containers.

A

I can now describe the runtime class itself and that will tell me information such as the part of a head that is incurred by this class. So you have a fixed amount of cpu and memory that is overhead for running inside a virtual machine.

A

So the cpu is used for things like I operations and the memory to run an additional kernel and have things like file buffers and so on, and so on.

A

So that's basically it in the next video we are going to see how to run workloads inside such sandbox containers a configuration. Thank you and see you in the next video.

A