3 ms·

Is it possible to add kata containers in eks or gke?

• otterley 3y ago
  Not in EKS. EC2 doesn't support nested virtualization today.
  • rwmj 3y ago
    Peer pods are meant to solve this (one day) by running the "containers" (ie VMs) to the side as regular AWS instances and peering the communications: https://www.redhat.com/en/blog/red-hat-openshift-sandboxed-containers-peer-pods-hands https://www.redhat.com/en/blog/red-hat-openshift-sandboxed-c...
    • otterley 3y ago
      AWS already has an implementation of this, namely, Nitro Enclaves. A Nitro Enclave is an isolated VM used for confidential computing purposes. You provide the Enclave an EIF file, which is basically an OCI image with cryptographic measurements. The Nitro hypervisor launches the VM and allows communications with its parent VM only over a Linux vsock connection. Also, AWS has Fargate, which is basically containers-as-VMs. Every ECS task or EKS Pod is launched as a separate EC2 instance under the hood. This obviates a lot of the need for a solution like Kata there.