Comment on Google Kubernetes Engine adds support for Arm nodesparentComments−vocram4yThe instance exposed by GCE is virtualized. If you want to run any hw virtualized workload inside it, you need nested virtualization.−bogomipz4yI'd be curious to hear more about your Kubernetes workloads. What virtualized hardware do your pods require?−dilyevsky4yAny untrusted workloads (say CI runners running your clients arbitrary code) better be run inside kata containers so you can’t use t2a vms for that−bogomipz4yIn GKE you can just enable GKE Sandbox/gVisor on a node pool to run your untrusted workloads. gVisor serves the same purpose as Kata containers.−dilyevsky4yYes except slow io−bogomipz4yCan you elaborate? What type of I/O, network, disk? What is the issue exactly?−dilyevsky4yYou can refer to gvisor performance docs - https://gvisor.dev/docs/architecture_guide/performance/#file... throughput is really terrible, same deal with networking and also if your userland issues a lot of syscalls−bogomipz4yThanks for the link. I'm curious, how is the I/O performance with Kata? Does it use VirtIO?−dilyevsky4yIt does and I believe with dax (if your kernel has it) it’s basically same speed as regular runc. 9p is still default tho i think
Comments
The instance exposed by GCE is virtualized. If you want to run any hw virtualized workload inside it, you need nested virtualization.
I'd be curious to hear more about your Kubernetes workloads. What virtualized hardware do your pods require?
Any untrusted workloads (say CI runners running your clients arbitrary code) better be run inside kata containers so you can’t use t2a vms for that
In GKE you can just enable GKE Sandbox/gVisor on a node pool to run your untrusted workloads. gVisor serves the same purpose as Kata containers.
Yes except slow io
Can you elaborate? What type of I/O, network, disk? What is the issue exactly?
You can refer to gvisor performance docs - https://gvisor.dev/docs/architecture_guide/performance/#file... throughput is really terrible, same deal with networking and also if your userland issues a lot of syscalls
Thanks for the link. I'm curious, how is the I/O performance with Kata? Does it use VirtIO?
It does and I believe with dax (if your kernel has it) it’s basically same speed as regular runc. 9p is still default tho i think