KubeVirt

Mentors: Student: Changlin Hu

KubeVirt extends Kubernetes with virtual machine (VM) APIs, virt-api is the component that serves these APIs to the cluster. Historically, the virt-api component has relied on a custom HTTP server implementation to manually handle TLS, authentication (Authn), authorization (Authz), API discovery, and OpenAPI serving. This VEP proposes migrating virt-api to the k8s.io/apiserver library to leverage the standard Kubernetes API server infrastructure. Adopting this upstream standard will significantly reduce maintenance overhead and enable seamless security updates for the system.

Mentors: Student: Sibasish Behera

Dynamic Resource Allocation (DRA) is a new feature introduced in Kubernetes version 1.26 and above, providing an Alpha API that allows users to define Kubernetes objects similar to the Persistent Volumes API for generic resources. With DRA, users can separate the declaration of a resource to be consumed from its actual consumption. This move away from the limited "countable" API provided by device plugins allows for a more flexible control over which resources are consumed and where they are allocated. For handling host devices, KubeVirt relies on the Kubernetes device plugin framework, which is crucial for scheduling, allocating, and attaching desired devices and resources to running pods. One limitation of this framework is the lack of persistence in device allocation when the pod is not running. The proposed solution involves implementing the DRA plugin in KubeVirt for PCI passthrough (with Nvme devices as a Proof of Concept). A DRA driver typically consists of two separate but coordinating components: a centralized controller and a node-local kubelet plugin. The kube-scheduler communicates with the centralized controller, which makes allocation decisions based on the overall cluster state and resource availability. The kubelet-plugins are responsible for discovering and advertising the node's available resources to the kubelet. Additionally, the proposed approach suggests enhancing the VirtualMachineInstance (VMI) resource to include resourceClaims under hostDevices. This way, users can create a VMI resource that references a ResourceClaim (Template) which in turn references a registered ResourceClass. KubeVirt components need to be modified to translate the resource claims in the VMI host devices into the PodSpec of the underlying Pod. Finally, the device driver would be deployed along with virt-handler as part of a DaemonSet. In summary, this approach aims to leverage the DRA capabilities to enhance host devices allocation

Mentors: Student: Ammar Yasser Adel

porting the KubeVirtCI bash code into the existing gocli. by dividing the bash code across methods in a kubevirt provider base type and optional Exec functions for extras like rook-ceph, realtime.. etc. the final deliverable is the gocli tool extended with the new functionality able to run directly on the host system with the need of running in a container

Mentors: Student: Nithish Karthik

Seccomp is a security facility from the Linux Kernel that prevents processes from executing unauthorised syscalls. By limiting the number of permitted syscalls, seccomp is being utilised in conjunction with Kubernetes to reduce the attack surface of the containers. KubeVirt already supports custom Seccomp profiles, but that is based on the default seccomp profile that cri-o uses. This static approach leaves room for the profile to block necessary syscalls or allow unnecessary syscalls, hence compromising the security. This project focuses on automating the process of generating a seccomp profile for the VirtLauncher pod.

Managing virtualization workloads on Kubernetes.