7 ms·
It's quite light on details: What properties does the (virtualized) ARM CPU that one gets have? Can it do KVM itself (meaning the underlying real CPU has suppor
by Klasiaster 4y ago
It's quite light on details: What properties does the (virtualized) ARM CPU that one gets have? Can it do KVM itself (meaning the underlying real CPU has support for nested KVM)? Can it do ARMv8.3 pointer authentication?
- my123 4y agoIt's an Ampere Altra for those first instances. So no on both.
- Klasiaster 4y agoThey could have named Ampere and give credit to them, I think it's common in cloud instance offerings to have AMD or Intel also being named as underlying physical CPUs, even with the generation.
- milesward 4y agoThey did in the docs, 2nd paragraph of the blog post, etc https://cloud.google.com/blog/products/compute/tau-t2a-is-first-compute-engine-vm-on-an-arm-chip https://cloud.google.com/blog/products/compute/tau-t2a-is-fi...
- Klasiaster 4y agoThanks, yes, makes sense to look at the GCE announcement instead of the GKE announcement for this info.
- bogomipz 4y agoI'd be curious to hear what the use case is for nested KVM. What hardware support is required for that as well?
- vocram 4y agoThe instance exposed by GCE is virtualized. If you want to run any hw virtualized workload inside it, you need nested virtualization.
- bogomipz 4y agoI'd be curious to hear more about your Kubernetes workloads. What virtualized hardware do your pods require?
- dilyevsky 4y agoAny untrusted workloads (say CI runners running your clients arbitrary code) better be run inside kata containers so you can’t use t2a vms for that
- bogomipz 4y agoIn GKE you can just enable GKE Sandbox/gVisor on a node pool to run your untrusted workloads. gVisor serves the same purpose as Kata containers.
- dilyevsky 4y agoYes except slow io
- bogomipz 4y agoCan you elaborate? What type of I/O, network, disk? What is the issue exactly?
- dilyevsky 4y agoYou can refer to gvisor performance docs - https://gvisor.dev/docs/architecture_guide/performance/#file-system https://gvisor.dev/docs/architecture_guide/performance/#file... throughput is really terrible, same deal with networking and also if your userland issues a lot of syscalls