clh: Summarize and track the status of cloud-hypervisor integration

[likebreath]

This issue provides an overview of the process to finish the cloud-hypervisor (clh) integration in Kata, and helps to track the integration progress. It also provides a common place for developers to share thoughts and give feedback. What's more, for detailed issues/PRs related to the integration, please check this project: https://github.com/orgs/kata-containers/projects/21.

The integration process are divided into the following categories (which can be interdependent):

• Complete the implementation for the Hypervisor interface functions

  • Target: Provide complete and seamless support of clh in Kata by following Kata's Hypervisor interface specification.
  • Status: All core functionalities are covered, along with few improvements working-in-progress. Also, some of the APIs are not needed for now (mainly legacy). Note kata 2.0 is on parity with kata 1.x (clh: Migrate the development efforts on cloud-hypervisor to Kata 2.0 kata-containers#461). Details are tracked here clh: Complete the 'hypervisor' interface functions in the clh driver code #2544.

• Pass all (applicable) integration tests (on Docker and Kubernetes) and extend CI coverage

  • Target: Stabilize the implementation and assure high confidence to use clh in Kata.
  • Status: All k8s test is passing and one test on docker is skipped. Details are tracked here ci: clh: List of skipped integration tests for both docker and k8s tests#2399. Comprehensive CI coverage for kata 1.x (details in this Wiki page), including functional/minmal, docker, k8s-containerd, k8s-e2e (both crio and containerd), podman, vfio, and metrics. Major outstanding items are: 1) debug and fix known issues (listed here); 2) extend our CI coverage for kata 2.0, where we are only covering k8s+containerd (clh: Extend the CI coverage for cloud-hypervisor in Kata 2.0 ci#345).

• Enable applicable clh features

  • Target: Bring all (applicable) features of clh to Kata to boost performance/security.
  • Status: The support for clh REST APIs are mostly done with more features are working-in-progress, such as:
    • Status of REST APIs usage: clh: Usage of REST APIs in Kata #2541
    • VFIO support: clh: add vfio support #2519
    • Use pmem (w/ read-only) to boot kata image: to-be-added
    • Enable block device hotplug clh: Enable disk block device hotplug support  #2570
    • Use virtio-mem as experimental feature clh: Enable virtio-mem #2568
    • SGX support (runtime: add support for SGX kata-containers#484)
    • Enable the seccomp enforcement for all worker threads in clh (clh: Complete the 'seccomp' filter list based on the workload from Kata's CI  #2901)

• Misc: the following are few related topics (lower-priority in general)

  • Rust agent: Rootfs builder: build rust agent using osbuilder osbuilder#361
    More tests and other corner case tests require manual validation
    • increase unit tests for clh implementation up to 80%
    • k8s end-to-end test in Kata clh: Enable disk block device hotplug support  #2570 clh: Enable Kubernetes e2e for cloud-hypervisor tests#2417,
  • Guest kernel: now using experimental kernel with several patches
  • Packaging and configuration
  • Rootless hypervisor

Note: @jcvenegas is the main contributor behind this integration effort. @ericooper introduced the the initial support of clh in Kata with #2164. @sboeuf is our clh consultant on-demand and guided us to fix the notorious test failure (kata-containers/tests#2141). Of course, the integration process won't be possible without numerous code reviews and bug fixings offered by many Kata developers.

See the complete list of missing items

[likebreath]

/cc @jcvenegas @amshinde @sameo @sboeuf @rbradford

[amshinde]

@likebreath I would also add support for block devices to the list. This would be helpful un supporting persistent volumes in k8s that are backed by block devices.

[sboeuf]

FYI, Cloud-Hypervisor supports virtio-blk, and we just added the support for hotplugging block devices. So I think this should be able to cover the use case with volumes.

[likebreath]

@amshinde @jcvenegas I just updated this mega issue (summary) and also its sub-issues. Please feel free to make changes as you find necessary. Any questions or comments, please let me know. Thanks.

[jodh-intel]

@likebreath - should this be release-gating (for 2.0)?

[likebreath]

@jodh-intel I don't think so, given major missing items are mostly for improvements, e.g. fixing enabling the skipped k8s/docker tests and extending CI coverage (mainly in kata 2.0), etc. wdyt? @amshinde @jcvenegas

[fidencio]

---

This issue is being automatically closed as Kata Containers 1.x has now reached EOL (End of Life). This means it is no longer being maintained.

Important:

All users should switch to the latest Kata Containers 2.x release to ensure they are using a maintained release that contains the latest security fixes, performance improvements and new features.

This decision was discussed by the @kata-containers/architecture-committee and has been announced via the Kata Containers mailing list:

• http://lists.katacontainers.io/pipermail/kata-dev/2020-November/001601.html
• http://lists.katacontainers.io/pipermail/kata-dev/2021-April/001843.html
• http://lists.katacontainers.io/pipermail/kata-dev/2021-May/001896.html

If you believe this issue still applies to Kata Containers 2.x, please open an issue against the Kata Containers 2.x repository, pointing to this one, providing details to allow us to migrate it.

---