Sandboxed Containers Support for OpenShift

Procedure

1. Create a NodeFeatureDiscovery resource to detect node capabilities suitable for running Kata containers:

   1. Save the following YAML in the nfd.yaml file:

      apiVersion: nfd.openshift.io/v1
      kind: NodeFeatureDiscovery
      metadata:
        name: nfd-kata
        namespace: openshift-nfd
      spec:
        operand:
          image: quay.io/openshift/origin-node-feature-discovery:4.10
          imagePullPolicy: Always
          servicePort: 12000
        workerConfig:
          configData: |
            sources:
               custom:
                 - name: "feature.node.kubernetes.io/runtime.kata"
                   matchOn:
                     - cpuId: ["SSE4", "VMX"]
                       loadedKMod: ["kvm", "kvm_intel"]
                     - cpuId: ["SSE4", "SVM"]
                       loadedKMod: ["kvm", "kvm_amd"]

      Copy to Clipboard Toggle word wrap

   2. Create the NodeFeatureDiscovery custom resource (CR):

      $ oc create -f nfd.yaml

      Copy to Clipboard Toggle word wrap

      Example output

      nodefeaturediscovery.nfd.openshift.io/nfd-kata created

      Copy to Clipboard Toggle word wrap

      A feature.node.kubernetes.io/runtime.kata=true label is applied to all qualifying worker nodes.

2. Set the checkNodeEligibility field to true in the KataConfig resource to enable the feature, for example:

   1. Save the following YAML in the kata-config.yaml file:

      apiVersion: kataconfiguration.openshift.io/v1
      kind: KataConfig
      metadata:
        name: example-kataconfig
      spec:
        checkNodeEligibility: true

      Copy to Clipboard Toggle word wrap

   2. Create the KataConfig CR:

      $ oc create -f kata-config.yaml

      Copy to Clipboard Toggle word wrap

      Example output

      kataconfig.kataconfiguration.openshift.io/example-kataconfig created

      Copy to Clipboard Toggle word wrap

Procedure

1. From the Administrator perspective in the web console, navigate to Operators → OperatorHub.
2. In the Filter by keyword field, type OpenShift sandboxed containers.
3. Select the OpenShift sandboxed containers tile.
4. Read the information about the Operator and click Install.

5. On the Install Operator page:

   1. Select stable-1.3 from the list of available Update Channel options.

   2. Verify that Operator recommended Namespace is selected for Installed Namespace. This installs the Operator in the mandatory openshift-sandboxed-containers-operator namespace. If this namespace does not yet exist, it is automatically created.

      Note

      Attempting to install the OpenShift sandboxed containers Operator in a namespace other than openshift-sandboxed-containers-operator causes the installation to fail.

   3. Verify that Automatic is selected for Approval Strategy. Automatic is the default value, and enables automatic updates to OpenShift sandboxed containers when a new z-stream release is available.
6. Click Install.

Verification

1. From the Administrator perspective in the web console, navigate to Operators → Installed Operators.
2. Verify that the OpenShift sandboxed containers Operator is listed in the in operators list.

Procedure

1. From the Administrator perspective in the web console, navigate to Operators → Installed Operators.
2. Select the OpenShift sandboxed containers Operator from the list of operators.
3. In the KataConfig tab, click Create KataConfig.
4. In the Create KataConfig page, select to configure the KataConfig CR via YAML view.

5. Copy and paste the following manifest into the YAML view:

   apiVersion: kataconfiguration.openshift.io/v1
   kind: KataConfig
   metadata:
     name: cluster-kataconfig
   spec:
     kataMonitorImage: registry.redhat.io/openshift-sandboxed-containers/osc-monitor-rhel8:1.3.0

   Copy to Clipboard Toggle word wrap

   If you want to install kata as a RuntimeClass only on selected nodes, include the label in the manifest:

   apiVersion: kataconfiguration.openshift.io/v1
   kind: KataConfig
   metadata:
     name: cluster-kataconfig
   spec:
     kataMonitorImage: registry.redhat.io/openshift-sandboxed-containers/osc-monitor-rhel8:1.3.0
     kataConfigPoolSelector:
       matchLabels:
         <label_key>: '<label_value>' 

   1

   Copy to Clipboard Toggle word wrap

   1

   Labels in kataConfigPoolSelector only support single values; nodeSelector syntax is not supported.

6. Click Create.

Verification

1. In the KataConfig tab, select the new KataConfig CR.
2. In the KataConfig page, select the YAML tab.

3. Monitor the installationStatus field in the status.

   A message appears each time there is an update. Click Reload to view the updated KataConfig CR.

   Once the value of Completed nodes equals the number of worker or labeled nodes, the installation is complete. The status also contains a list of nodes where the installation is completed.

Procedure

1. From the Administrator perspective in the web console, expand Workloads and select the type of workload you want to create.
2. In the workload page, click to create the workload.

3. In the YAML file for the workload, in the spec field where the container is listed, add runtimeClassName: kata.

   Example for Pod object

   apiVersion: v1
   kind: Pod
   metadata:
     name: hello-openshift
     labels:
       app: hello-openshift
   spec:
     runtimeClassName: kata
     containers:
       - name: hello-openshift
         image: quay.io/openshift/origin-hello-openshift
         ports:
           - containerPort: 8888
         securityContext:
           privileged: false
           allowPrivilegeEscalation: false
           runAsNonRoot: true
           runAsUser: 1001
           capabilities:
             drop:
               - ALL
           seccompProfile:
             type: RuntimeDefault

   Copy to Clipboard Toggle word wrap

4. Click Save.

Procedure

1. Create the Namespace object for the OpenShift sandboxed containers Operator.

   1. Create a Namespace object YAML file that contains the following manifest:

      apiVersion: v1
      kind: Namespace
      metadata:
        name: openshift-sandboxed-containers-operator

      Copy to Clipboard Toggle word wrap

   2. Create the Namespace object:

      $ oc create -f Namespace.yaml

      Copy to Clipboard Toggle word wrap

2. Create the OperatorGroup object for the OpenShift sandboxed containers Operator.

   1. Create an OperatorGroup object YAML file that contains the following manifest:

      apiVersion: operators.coreos.com/v1
      kind: OperatorGroup
      metadata:
        name: openshift-sandboxed-containers-operator
        namespace: openshift-sandboxed-containers-operator
      spec:
        targetNamespaces:
        - openshift-sandboxed-containers-operator

      Copy to Clipboard Toggle word wrap

   2. Create the OperatorGroup object:

      $ oc create -f OperatorGroup.yaml

      Copy to Clipboard Toggle word wrap

3. Create the Subscription object to subscribe the Namespace to the OpenShift sandboxed containers Operator.

   1. Create a Subscription object YAML file that contains the following manifest:

      apiVersion: operators.coreos.com/v1alpha1
      kind: Subscription
      metadata:
        name: openshift-sandboxed-containers-operator
        namespace: openshift-sandboxed-containers-operator
      spec:
        channel: "stable-1.3"
        installPlanApproval: Automatic
        name: sandboxed-containers-operator
        source: redhat-operators
        sourceNamespace: openshift-marketplace
        startingCSV: sandboxed-containers-operator.v1.3.1

      Copy to Clipboard Toggle word wrap

   2. Create the Subscription object:

      $ oc create -f Subscription.yaml

      Copy to Clipboard Toggle word wrap

Procedure

1. Create a YAML file with the following manifest:

   apiVersion: kataconfiguration.openshift.io/v1
   kind: KataConfig
   metadata:
     name: cluster-kataconfig
   spec:
     kataMonitorImage: registry.redhat.io/openshift-sandboxed-containers/osc-monitor-rhel8:1.3.0

   Copy to Clipboard Toggle word wrap

2. (Optional) If you want to install kata as a RuntimeClass only on selected nodes, create a YAML file that includes the label in the manifest:

   apiVersion: kataconfiguration.openshift.io/v1
   kind: KataConfig
   metadata:
     name: cluster-kataconfig
   spec:
     kataMonitorImage: registry.redhat.io/openshift-sandboxed-containers/osc-monitor-rhel8:1.3.0
     kataConfigPoolSelector:
       matchLabels:
         <label_key>: '<label_value>' 

   1

   Copy to Clipboard Toggle word wrap

   1

   Labels in kataConfigPoolSelector only support single values; nodeSelector syntax is not supported.

3. Create the KataConfig resource:

   $ oc create -f <file name>.yaml

   Copy to Clipboard Toggle word wrap

Procedure

1. From the Administrator perspective, navigate to Workloads → Pods.
2. Search for the pod that you want to delete using the Search by name field.
3. Click the pod name to open it.
4. On the Details page, check that kata is displayed for Runtime class.
5. Click the Actions menu and select Delete Pod.
6. Click Delete in the confirmation window.

Procedure

1. From the Administrator perspective, navigate to Operators → Installed Operators.
2. Search for the OpenShift sandboxed containers Operator using the Search by name field.
3. Click the Operator to open it, and then select the KataConfig tab.
4. Click the Options menu for the KataConfig resource, and then select Delete KataConfig.
5. Click Delete in the confirmation window.

Procedure

1. From the Administrator perspective, navigate to Operators → Installed Operators.
2. Search for the OpenShift sandboxed containers Operator using the Search by name field.
3. Click the Options menu for the Operator and select Uninstall Operator.
4. Click Uninstall in the confirmation window.

Procedure

1. From the Administrator perspective, navigate to Administration → Namespaces.
2. Search for the openshift-sandboxed-containers-operator namespace using the Search by name field.

3. Click the Options menu for the namespace and select Delete Namespace.

   Note

   If the Delete Namespace option is not available, you do not have permission to delete the namespace.

4. In the Delete Namespace pane, enter openshift-sandboxed-containers-operator and click Delete.
5. Click Delete.

Procedure

1. From the Administrator perspective, navigate to Administration → CustomResourceDefinitions.
2. Search for KataConfig using the Search by name field.
3. Click the Options menu for the KataConfig CRD, and then select Delete CustomResourceDefinition.
4. Click Delete in the confirmation window.
5. Wait for the KataConfig CRD to disappear from the list. This can take several minutes.

Procedure

1. Search for pods that use kata as the runtimeClass by running the following command:

   $ oc get pods -A -o json | jq -r '.items[] | select(.spec.runtimeClassName == "kata").metadata.name'

   Copy to Clipboard Toggle word wrap

2. To delete each pod, run the following command:

   $ oc delete pod <pod-name>

   Copy to Clipboard Toggle word wrap

Procedure

1. Fetch the cluster service version (CSV) name for OpenShift sandboxed containers from the subscription by running the following command:

   CSV_NAME=$(oc get csv -n openshift-sandboxed-containers-operator -o=custom-columns=:metadata.name)

   Copy to Clipboard Toggle word wrap

2. Delete the OpenShift sandboxed containers Operator subscription from Operator Lifecyle Manager (OLM) by running the following command:

   $ oc delete subscription sandboxed-containers-operator -n openshift-sandboxed-containers-operator

   Copy to Clipboard Toggle word wrap

3. Delete the CSV name for OpenShift sandboxed containers by running the following command:

   $ oc delete csv ${CSV_NAME} -n openshift-sandboxed-containers-operator

   Copy to Clipboard Toggle word wrap

4. Fetch the OpenShift sandboxed containers Operator group name by running the following command:

   $ OG_NAME=$(oc get operatorgroup -n openshift-sandboxed-containers-operator -o=jsonpath={..name})

   Copy to Clipboard Toggle word wrap

5. Delete the OpenShift sandboxed containers Operator group name by running the following command:

   $ oc delete operatorgroup ${OG_NAME} -n openshift-sandboxed-containers-operator

   Copy to Clipboard Toggle word wrap

6. Delete the OpenShift sandboxed containers namespace by running the following command:

   $ oc delete namespace openshift-sandboxed-containers-operator

   Copy to Clipboard Toggle word wrap

Procedure

1. From the Administrator perspective of OpenShift Container Platform, navigate to Operators → Installed Operators.
2. Select the OpenShift sandboxed containers Operator and go to the KataConfig tab.
3. Search for the KataConfig resource using the Search by name field. The default name for the KataConfig resource is example-kataconfig.
4. Select the KataConfig resource and go to the KataConfig tab.

5. Modify the version number for kataMonitorImage:

       checkNodeEligibility: false
       kataConfigPoolSelector: null
       kataMonitorImage: 'registry.redhat.io/openshift-sandboxed-containers/osc-monitor-rhel8:1.3.0'

   Copy to Clipboard Toggle word wrap
6. Click Save.