docs(day-2): Added multitenancy talk
This commit is contained in:
@@ -9,6 +9,8 @@ This "blog" certainly contains a bunch of tyops.
|
||||
This is what typing the notes blindly in real time get's you.
|
||||
Every year I tell myself that I will fix them afterwards: To be fair I fix most of them but not all and that's fine.
|
||||
|
||||
Also the notes tend to start out strong early in the week (aka Rejekts + CloudNativeCon) and fall off in terms of density and depth.
|
||||
|
||||
## How did I get there?
|
||||
|
||||
I attended Cloud Native Rejekts and KubeCon + CloudNativeCon Europe 2026 in Amsterdam.
|
||||
|
||||
33
content/day-2/08-multitenancy.md
Normal file
33
content/day-2/08-multitenancy.md
Normal file
@@ -0,0 +1,33 @@
|
||||
---
|
||||
title: "Push the boundaries of kubernetes multi-tenancy with containerruntimeclasses"
|
||||
weight: 8
|
||||
tags:
|
||||
- rejekts
|
||||
- runtime
|
||||
---
|
||||
|
||||
<!-- {{% button href="https://youtu.be/rkteV6Mzjfs" style="warning" icon="video" %}}Watch talk on YouTube{{% /button %}} -->
|
||||
<!-- {{% button href="https://docs.google.com/presentation/d/1nEK0CVC_yQgIDqwsdh-PRihB6dc9RyT-" style="tip" icon="person-chalkboard" %}}Slides{{% /button %}} -->
|
||||
<!-- {{% button href="https://github.com/graz-dev/automatic-reosurce-optimization-loop" style="info" icon="code" %}}Code/Demo{{% /button %}} -->
|
||||
|
||||
I missed the first 3 minutes of this talk because they started ealy so the notes are currently missing the first levels of multi-tenancy
|
||||
This was a real interesting introduction into the world of runtime classes and how you could use them to choose the right level of isolation for each of your pods/deployments utilizing different runtimes/shims. Running everything from normal containers to hardened/Emulated processes and vms side-by-side in kubernetes.
|
||||
|
||||
## Levels of multi-tenancy
|
||||
|
||||
- God-Level: A physical clusters seperated out in multiple virtual clusters which can be isolated into even more nested virtual clusters (for )
|
||||
- Problem: We're using the same container runtime
|
||||
|
||||
## Runtimes
|
||||
|
||||
- There are different runtimes since TODO -> They replaced dockershim as the runtime in 1.24
|
||||
- Choice can range from cri-o )performant) to kata containers (secure)
|
||||
- In the past there was no plugin architecture (node had to be reinstalled and restarted to switch cri) now you just have to update the container confug through a new RuntimeClass
|
||||
- Can be targeted for each Pod/Deployment Spec
|
||||
- You can still use containerd as the default class with shims (Shim v2 Project) for specialized runtimes like kata or windows
|
||||
- Expansion: KubeVirt - vms as a runtime class (also implemented by others like kata with qemu isolation)
|
||||
|
||||
## Pro/Con
|
||||
|
||||
- Pro: Security, Cost optimization, Performance optimization, diversity/flexibility
|
||||
- Con: Day2 complexity, complex debugging (anyone say networking), additional costs of using VMs
|
||||
@@ -8,14 +8,4 @@ TODO:
|
||||
|
||||
## Other stuff I learned or people i talk to
|
||||
|
||||
- Isovalent
|
||||
- Kubermatic
|
||||
- Portworx
|
||||
- Fastly
|
||||
- Syseleven
|
||||
- Netbird
|
||||
- VMware
|
||||
- Stackit
|
||||
- Harness
|
||||
- Mia Platform
|
||||
- and many, many more...
|
||||
- TODO:
|
||||
Reference in New Issue
Block a user