b9d88f74ed
The kata webhook requires a configmap to define what runtime class it should set for the newly created pods. Additionally, the configmap allows others to modify the default runtime class name we wish to set (in case the handler is kata but the name of the runtimeclass is different). Finally, this PR changes the webhook-check to compare the runtime of the newly created pod against the specific runtime class in the configmap, if said confimap doesn't exist, then it will default to "kata". Signed-off-by: Martin <mheberling@microsoft.com>
Kata Admission controller webhook
Implement a simple admission controller webhook to annotate pods with the Kata runtime class.
How to build the admission controller
Note: Only run this step if you are modifying the current webhook or don't want to use the webhook available in docker hub.
First build the admission controller image and the associated Kubernetes YAML files required to instantiate the admission controller.
docker build -t quay.io/kata-containers/kata-webhook-example:latest -f Dockerfile .
Note
Image needs to be published for the webhook needs to work. Alternately on a single machine cluster change the
imagePullPolicyto use the locally built image.
Making Kata the default runtime using an admission controller
Today in crio.conf runc is the default runtime when a user does not specify
runtimeClass in the pod spec. If you want to run a cluster where Kata is used
by default, except for workloads we know for sure will not work with Kata, use
the admission webhook
and sample admission controller we created by running the commands below:
Note
By default, the
runtimeClassname used in this webhook iskata. If your cluster is configured with anotherruntimeClass, you'll need to change the value of theRUNTIME_CLASSenvironment variable defined in the webhook file. You can manually edit the file or run:
export RUNTIME_CLASS=<>
kubectl create cm kata-webhook --from-literal runtime_class=$RUNTIME_CLASS
./create-certs.sh
kubectl apply -f deploy/
Afterwards you can run the webhook-check.sh script to check the webhook was
deployed correctly and is working:
./webhook-check.sh
The webhook mutates pods to use the Kata runtime class for all pods except those with
hostNetwork: true- namespace:
rook-cephandrook-ceph-system