Interconnecting iSula with the shim v2 Secure Container
Overview
shim v2 is a next-generation shim solution. Compared with shim v1, shim v2 features shorter call chains, clearer architecture, and lower memory overhead in multi-service container scenarios. iSula can run secure containers through isulad-shim or containerd-shim-kata-v2. The isulad-shim component is the implementation of the shim v1 solution, and the containerd-shim-kata-v2 component is the implementation of the shim v2 solution in the secure container scenario. This document describes how to interconnect iSula with containerd-shim-kata-v2.
Interconnecting with containerd-shim-kata-v2
Prerequisites
Before interconnecting iSula with containerd-shim-kata-v2, ensure that the following prerequisites are met:
- iSulad and kata-containers have been installed.
- StratoVirt supports only the devicemapper storage driver. Therefore, you need to configure the devicemapper environment and ensure that the devicemapper storage driver used by iSulad works properly.
Environment Setup
The following describes how to install and configure iSulad and kata-containers.
Installing Dependencies
Configure the Yum source based on the OS version and install iSulad and kata-containers as the root user.
yum install iSulad
yum install kata-containers
Creating and Configuring a Storage Device
Prepare a drive, for example, /dev/sdx. The drive will be formatted. This section uses the block device /dev/sda as an example.
I. Creating devicemapper
Create a physical volume (PV).
$ pvcreate /dev/sda Physical volume "/dev/loop0" successfully created.
Create a volume group (VG).
$ vgcreate isula /dev/sda Volume group "isula" successfully created
Create the logical volumes thinpool and thinpoolmeta.
$ lvcreate --wipesignatures y -n thinpool isula -l 95%VG Logical volume "thinpool" created. $ lvcreate --wipesignatures y -n thinpoolmeta isula -l 1%VG Logical volume "thinpoolmeta" created.
Convert the created logical volumes to a thin pool.
$ lvconvert -y --zero n -c 64K \ --thinpool isula/thinpool \ --poolmetadata isula/thinpoolmeta Thin pool volume with chunk size 512.00 KiB can address at most 126.50 TiB of data. WARNING: Converting isula/thinpool and isula/thinpoolmeta to thin pool's data and metadata volumes with metadata wiping. THIS WILL DESTROY CONTENT OF LOGICAL VOLUME (filesystem etc.) Converted isula/thinpool and isula/thinpoolmeta to thin pool.
Configure automatic extension of the thin pool using lvm.
$ touch /etc/lvm/profile/isula-thinpool.profile $ cat << EOF > /etc/lvm/profile/isula-thinpool.profile activation { thin_pool_autoextend_threshold=80 thin_pool_autoextend_percent=20 } EOF $ lvchange --metadataprofile isula-thinpool isula/thinpool Logical volume isula/thinpool changed.
II. Changing the iSulad Storage Driver Type and Setting the Default Runtime
Modify the /etc/isulad/daemon.json configuration file. Set default-runtime to io.containerd.kata.v2 and storage-driver to devicemapper. The modification result is as follows:
{
"default-runtime": "io.containerd.kata.v2",
"storage-driver": "devicemapper",
"storage-opts": [
"dm.thinpooldev=/dev/mapper/isula-thinpool",
"dm.fs=ext4",
"dm.min_free_space=10%"
],
}
III. Making the Configuration Take Effect
Restart the iSulad for the configuration to take effect.
# systemctl daemon-reload # systemctl restart isulad
Check whether the iSula storage driver is successfully configured.
# isula info
If the following information is displayed, the configuration is successful:
Storage Driver: devicemapper
Interconnection Guide
This section describes how to interconnect iSula with containerd-shim-kata-v2.
By default, containerd-shim-kata-v2 uses QEMU as the virtualization component. The following describes how to configure QEMU and StratoVirt.
Using QEMU
If containerd-shim-kata-v2 uses QEMU as the virtualization component, perform the following operations to interconnect iSula with containerd-shim-kata-v2:
Modify the kata configuration file /usr/share/defaults/kata-containers/configuration.toml.
Set sandbox_cgroup_with_emulator to false. Currently, shim v2 does not support this function. Other parameters are the same as the kata configuration parameters in shim v1 or use the default values.
sandbox_cgroup_with_emulator = false
Use the BusyBox image to run the secure container and check whether the used runtime is io.containerd.kata.v2.
$ id=`isula run -tid busybox /bin/sh` $ isula inspect -f '{{ json .HostConfig.Runtime }}' $id "io.containerd.kata.v2"
Verify that the QEMU-based VM process is started. If it is started, QEMU is successfully interconnected with the shim v2 secure container.
ps -ef | grep qemu
Using StratoVirt
If containerd-shim-kata-v2 uses StratoVirt as the virtualization component, perform the following operations to interconnect iSula with containerd-shim-kata-v2:
Create the stratovirt.sh script in any directory (for example, /home) and add the execute permission to the file as the root user.
# touch /home/stratovirt.sh # chmod +x /home/stratovirt.sh
The content of stratovirt.sh is as follows, which is used to specify the path of StratoVirt:
#!/bin/bash export STRATOVIRT_LOG_LEVEL=info # set log level which includes trace, debug, info, warn and error. /usr/bin/stratovirt $@
Modify the kata configuration file. Set hypervisor of the secure container to stratovirt, kernel to the absolute path of the StratoVirt kernel image, and initrd to the initrd image file of kata-containers (if you use YUM to install kata-containers, the initrd image file is downloaded by default and stored in the /var/lib/kata/ directory). StratoVirt supports only the devicemapper storage mode, prepare the environment in advance and set iSulad to the devicemapper mode.
The configurations are as follows:
[hypervisor.stratovirt] path = "/home/stratovirt.sh" kernel = "/var/lib/kata/vmlinux.bin" initrd = "/var/lib/kata/kata-containers-initrd.img" block_device_driver = "virtio-mmio" use_vsock = true enable_netmon = true internetworking_model="tcfilter" sandbox_cgroup_with_emulator = false disable_new_netns = false disable_block_device_use = false disable_vhost_net = true
To use the vsock function in StratoVirt, enable the vhost_vsock kernel module and check whether the module is successfully enabled.
modprobe vhost_vsock lsmod |grep vhost_vsock
Download the kernel of the required version and architecture and save it to the /var/lib/kata/ directory. For example, download the openeuler repo of the x86 architecture of openEuler 21.03.
cd /var/lib/kata wget https://repo.openeuler.org/openEuler-21.03/stratovirt_img/x86_64/vmlinux.bin
Use the BusyBox image to run the secure container and check whether the used runtime is io.containerd.kata.v2.
$ id=`isula run -tid busybox sh` $ isula inspect -f '{{ json .HostConfig.Runtime }}' $id "io.containerd.kata.v2"
Verify that the StratoVirt-based VM process is started. If it is started, StratoVirt is successfully interconnected with the shim v2 secure container.
ps -ef | grep stratovirt