Running KubeVirt Workloads with No Additional Privileges
summary
KubeVirt now runs VMs without granting cluster-wide extra privileges by landing a rootless user mode that combines libvirt’s unmanaged networking, offloading privileged setup to a small privileged handler, and using Kubernetes features like emptyDir to set runtime permissions. The build uses libvirt, device plugins, and SELinux/AppArmor; it adds vTPM support and documents tradeoffs: file capabilities vs. ambient capabilities, FSGroup limits on storage, and inconsistent host device permissions. The rootless flow is implemented and used in upstream KubeVirt.
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:24What is coming?
- 1:15How does the Kubernetes look like?
- 2:05Node perspective
- 4:53How is security enforced?
- 5:38Security policies
- 7:32That's one small step for security
- 11:20Storage for non-root user
- 12:21Devices for non-root user
- 13:15Solution
- 13:53Capabilities for non-root containers
- 15:40Drawback
- 17:13What's left to do?
related talks
38mImproving your Kubernetes Workload Security
07mLightning Talk: Confidential VMs in Kubevirt: Securing VMs With Kube...
32mLotsa security - confining the extra security layer
34mTailor-Made Security: Building a Kubernetes Specific Hypervisor
40mUser Namespaces in Kubernetes: Security and Flexibility - Pick Both
28mUsernetes Gen2: Kubernetes in Rootless Docker, with Multiple Nodes
12mSecurity and Performance in the Delegated User-level Virtualization
31mTowards unprivileged container builds