Improving your Kubernetes Workload Security
summary
Two complementary approaches add hardware virtualization to Kubernetes: Kata Containers isolates each pod inside a lightweight VM so containers run on a per-pod Linux kernel via an OCI/CRI-compatible runtime (Kata ~1.0, uses KVM/QEMU); KubeVirt exposes a VM Custom Resource so traditional VMs run inside pods (current 0.4, not yet stable) and inherits Kubernetes scheduling and storage. Both share KVM/QEMU under the hood, move the IP into the VM (one virtual NIC today), and trade higher isolation for VM lifecycle and networking integration work.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 0:54What kind of workloads can Kubernetes run
- 3:05Hardware virtualization
- 4:50Kubernetes API
- 5:34Kubernetes Encounter Containers
- 7:32Kubernetes Custom Resource
- 8:48Adding Isolation Layers
- 13:37Kara Containers
- 16:29Legacy workloads
- 17:42Developer workflow
- 18:25Legacy application
- 19:01What should we do
- 19:43Kubernetes Virtualization Operator
- 21:14Deployment
- 22:03Cube
- 23:28Recap
- 24:59Questions
- 32:54Multiple runtimes
related talks
32mLotsa security - confining the extra security layer
36mKata Containers: Hypervisor-Based Container Runtime
39mMore Than Secure: Containerd + KataContainers as Kubernetes Runtime
14mA kernel? In a Container? Explain Yourself!
47mContainer Security
34mTailor-Made Security: Building a Kubernetes Specific Hypervisor
06mKeynote: Introducing Kata Containers
22mKata Containers: Security and Containers Without Compromise