mirror of
https://github.com/confidential-containers/confidential-containers.git
synced 2025-08-30 22:56:42 +00:00
e9c2f0f6a3
The operator-demo folder contains instruction to recreate the ssh demo. This demo works only with the older code in the operator `ccv0` branch. The code in `main` branch has deviated significantly and the existing ssh demo will not work when using the manifest from the main branch. Signed-off-by: Pradipta Banerjee <pradipta.banerjee@gmail.com>
121 lines
3.8 KiB
Markdown
121 lines
3.8 KiB
Markdown
<!-- TOC start -->
|
|
- [CCv0 Operator Demo](#ccv0-operator-demo)
|
|
* [Demo Video](#demo-video)
|
|
* [Demo Environment setup](#demo-environment-setup)
|
|
+ [Kubernetes cluster](#kubernetes-cluster)
|
|
+ [Replace containerd ](#replace-containerd)
|
|
+ [Verify if the cluster nodes are all up](#verify-if-the-cluster-nodes-are-all-up)
|
|
* [Operator Setup](#operator-setup)
|
|
* [Confidential Containers Runtime setup](#confidential-containers-runtime-setup)
|
|
<!-- TOC end -->
|
|
|
|
# CCv0 Operator Demo
|
|
|
|
## Demo Video
|
|
|
|
The demo shows CCv0 Kata runtime installation and configuration using the [operator](https://github.com/confidential-containers/operator).
|
|
|
|
[Watch the demo in youtube](https://www.youtube.com/watch?v=4cM3IhfnJLQ)
|
|
|
|
|
|
## Demo Environment setup
|
|
|
|
### Kubernetes cluster
|
|
|
|
Setup a two nodes Kubernetes cluster using Ubuntu 20.04.
|
|
You can use your preferred Kubernetes setup tool. Here is an example
|
|
using [kcli](https://kcli.readthedocs.io/en/latest/)
|
|
|
|
Download ubuntu 20.04 image if not present
|
|
```
|
|
kcli download image ubuntu2004
|
|
```
|
|
|
|
Install the cluster
|
|
```
|
|
kcli create kube generic -P image=ubuntu2004 -P workers=1 testk8s
|
|
```
|
|
|
|
### Replace containerd
|
|
|
|
Replace containerd on the worker node by building a new containerd from the following
|
|
branch - https://github.com/confidential-containers/containerd/tree/ali-CCv0
|
|
|
|
Modify systemd configuration to use the new binary and restart containerd and kubelet
|
|
|
|
### Verify if the cluster nodes are all up
|
|
|
|
```
|
|
kubectl get nodes
|
|
```
|
|
Sample output from my demo environment
|
|
```
|
|
NAME STATUS ROLES AGE VERSION
|
|
cck8s-demo-master-0 Ready control-plane,master 25d v1.22.3
|
|
cck8s-demo-worker-0 Ready worker 25d v1.22.3
|
|
```
|
|
|
|
## Operator Setup
|
|
|
|
```
|
|
kubectl apply -f https://raw.githubusercontent.com/confidential-containers/operator/ccv0-demo/deploy/deploy.yaml
|
|
```
|
|
|
|
The operator installs everything under the `confidential-containers-system` namespace
|
|
|
|
Verify if the operator is running
|
|
|
|
```
|
|
kubectl get pods -n confidential-containers-system
|
|
```
|
|
|
|
Sample output from my demo environment
|
|
```
|
|
NAME READY STATUS RESTARTS AGE
|
|
cc-operator-controller-manager-7f8d6dd988-t9zdm 2/2 Running 0 13s
|
|
```
|
|
|
|
## Confidential Containers Runtime setup
|
|
|
|
Creating a `CCruntime` object sets up the container runtime
|
|
The default payload image sets up the CCv0 demo image of the kata-containers runtime.
|
|
|
|
```yaml
|
|
cat << EOF | kubectl create -f -
|
|
apiVersion: confidentialcontainers.org/v1beta1
|
|
kind: CcRuntime
|
|
metadata:
|
|
name: ccruntime-sample
|
|
namespace: confidential-containers-system
|
|
spec:
|
|
# Add fields here
|
|
runtimeName: kata
|
|
config:
|
|
installType: bundle
|
|
payloadImage: quay.io/confidential-containers/runtime-payload:ccv0-ssh-demo
|
|
EOF
|
|
```
|
|
This will create an install daemonset targeting the worker nodes for installation.
|
|
You can verify the status under the `confidential-containers-system` namespace
|
|
|
|
```
|
|
kubectl get pods -n confidential-containers-system
|
|
NAME READY STATUS RESTARTS AGE
|
|
cc-operator-controller-manager-7f8d6dd988-t9zdm 2/2 Running 0 82s
|
|
cc-operator-daemon-install-p9ntc 1/1 Running 0 45s
|
|
```
|
|
|
|
On successful installation, you'll see the following `runtimeClasses` being setup
|
|
|
|
```
|
|
kubectl get runtimeclasses.node.k8s.io
|
|
NAME HANDLER AGE
|
|
kata kata 92s
|
|
kata-cc kata-cc 92s
|
|
kata-qemu kata-qemu 92s
|
|
```
|
|
`kata-cc` runtimeclass uses CCv0 specific configurations.
|
|
|
|
Now you can deploy the PODs targeting the specific runtimeclasses.
|
|
The [SSH demo](/demos/ssh-demo) can be used as a compatible workload.
|