Create a RuntimeClass named untrusted using the prepared runtime handler named runsc. Create a Pods of image alpine:3.13.2 in the Namespace default to run on the gVisor runtime class.

Question

Explanation

The task requires creating a Kubernetes RuntimeClass for gVisor and then deploying a Pod configured to use this specific runtime class for enhanced isolation.

Approach. The correct interaction involves executing kubectl commands in the provided terminal to achieve the stated goals.

Step 1: Create the RuntimeClass named untrusted using the runsc handler. This requires defining a RuntimeClass resource. The most reliable method is to create a YAML file and apply it using kubectl apply:

cat <<EOF > untrusted-runtimeclass.yaml
apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata:
  name: untrusted
handler: runsc
EOF
kubelet apply -f untrusted-runtimeclass.yaml

(Optional verification: kubectl get runtimeclass untrusted -o yaml)

Step 2: Create a Pod of image alpine:3.13.2 in the default Namespace to run on the gVisor runtime class. Since we defined the untrusted RuntimeClass to use the runsc handler (which is gVisor), the Pod should specify runtimeClassName: untrusted. The kubectl run command is a concise way to create a simple Pod for exam purposes:

kubelet run gvisor-alpine-pod --image=alpine:3.13.2 --namespace=default --runtimeclass=untrusted --command -- sleep 3600

Note: The --command -- sleep 3600 ensures the Pod remains in a 'Running' state for assessment, as alpine images without a specified command typically exit immediately. The name gvisor-alpine-pod is arbitrary, but should be unique within the namespace. (Optional verification: kubectl get pod gvisor-alpine-pod -o yaml | grep runtimeClassName)

Common mistakes.

• common_mistake. A common mistake is confusing the RuntimeClass 'name' (untrusted) with its 'handler' (runsc), or incorrectly assuming 'gVisor' is a direct RuntimeClass name. The Pod's spec.runtimeClassName must refer to the name of the RuntimeClass object that was created (i.e., untrusted), not its underlying handler or technology. Forgetting to provide a long-running command (like sleep 3600) for the alpine:3.13.2 image in the Pod definition can cause the Pod to immediately exit, leading to it not being in a 'Running' state, which would likely result in an incorrect answer. Using an incorrect API version for the RuntimeClass (e.g., node.k8s.io/v1beta1 instead of v1 if only v1 is expected) or misspellings in resource names or image tags will also lead to command failures or incorrect results.

Concept tested. This question tests the candidate's understanding and practical application of Kubernetes RuntimeClasses, specifically for integrating alternative container runtimes like gVisor (via the 'runsc' handler) to provide enhanced workload isolation. It also assesses knowledge of kubectl commands for creating and managing Kubernetes resources, including defining custom runtime environments for Pods.

Reference. https://kubernetes.io/docs/concepts/containers/runtime-class/

No community discussion yet for this question.