Red Hat OpenShift Sandboxed Containers | Red Hat OpenShift, 17 Mar 2022

Previous Meeting

⏯

youtube image

►

From YouTube: Red Hat OpenShift sandboxed containers | Red Hat OpenShift Pipelines

Description

Isolating Red Hat OpenShift pipeline runs using Red Hat OpenShift sandboxed containers.

Learn more: https://www.redhat.com/en/openshift-sandboxed-containers

A

Hello: everyone in this demo, we will see how to use openshift sandbox containers to provide stronger isolation to openshift pipeline jobs. The demo environment is a six node openshift bare metal cluster.

A

We will see that openshift sandbox containers operator is already installed and cutter runtime is installed on the world controls. So this is the sata config custom resource and, as we can see, all the three worker nodes have kata installed.

A

Additionally, carter runtime class is created. We will use this runtime class later on in the demo.

A

Let's login to one of the worker nodes and see if any kata containers is running or not note that cutter containers are lightweight vms, so we'll check for qme instances on the worker nodes.

A

So as we can see, no cutter containers are running and we are just checking for the packages so cutter containers package is installed as well. So let's check for the same things on the other worker nodes as well.

A

So as we saw all the worker nodes have the carter runtime installed and there are no qatar containers running so now. Let's proceed with the sample application, demonstrating openshift pipelines and subsequent integration with sandbox containers.

A

The tutorial is in github, we'll just follow the instructions, as mentioned in the tutorial.

A

So we'll create the sample project and deploy the pipelines.

A

As we can see, the pipeline is all set up.

A

Now we will execute the pipelines by creating pipeline run instances. Let's look at the pipeline run manifest.

A

As you can see, the port template specifies the runtime class ascata. Now this ensures that all the jobs will be created as sandbox containers.

A

Now, let's take a look at the container and verify that it's running as a kata container.

A

So the container is running in worker, one: let's connect to worker one and verify the details.

A

So, as we can see, a qma instance is running, so this is a lightweight vm which is running the container.

A

Similarly, we can see the details for the other containers as well.

A

As you saw with a single line, change to the pipeline run manifest. You can execute your pipeline jobs with increased isolation using openshift sandbox containers, thanks for watching.