归档：Kata / microVM runner 实验（2026-09-17 工作区快照）
从旧工作区 chore/recover-old-workspace 清理时保存，内容与 2026-09-17
stash@{0} 快照中的版本一致；未合并、未在 main 上使用，仅作参考，不开 PR。
被 gitignore 的 tfstate 与凭据文件不在此分支，仍留在本地工作区。
Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
Claude Opus 5.5
@@ -0,0 +1,10 @@
|
||||
[defaults]
|
||||
inventory = inventory/hosts.yml
|
||||
host_key_checking = True
|
||||
interpreter_python = auto_silent
|
||||
retry_files_enabled = False
|
||||
local_tmp = /tmp/ansible-kata-lab-local
|
||||
remote_tmp = /tmp/ansible-kata-lab-remote
|
||||
|
||||
[ssh_connection]
|
||||
pipelining = True
|
||||
@@ -0,0 +1,8 @@
|
||||
---
|
||||
all:
|
||||
hosts:
|
||||
kata-lab:
|
||||
ansible_host: 192.168.10.13
|
||||
ansible_user: ansible
|
||||
vars:
|
||||
ansible_become: true
|
||||
@@ -0,0 +1,88 @@
|
||||
---
|
||||
- name: Install Kata Containers in the disposable k3s lab
|
||||
hosts: kata-lab
|
||||
gather_facts: false
|
||||
vars:
|
||||
kata_version: "4.1.0"
|
||||
kata_chart_url: >-
|
||||
https://github.com/kata-containers/kata-containers/releases/download/{{ kata_version }}/kata-deploy-{{ kata_version }}.tgz
|
||||
tasks:
|
||||
- name: Check nested KVM is usable
|
||||
ansible.builtin.stat:
|
||||
path: /dev/kvm
|
||||
register: kata_kvm
|
||||
|
||||
- name: Require nested KVM
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- kata_kvm.stat.exists
|
||||
- kata_kvm.stat.ischr
|
||||
fail_msg: /dev/kvm is unavailable; Kata QEMU cannot start efficiently
|
||||
|
||||
- name: Install Kata through the k3s Helm controller
|
||||
ansible.builtin.copy:
|
||||
dest: /var/lib/rancher/k3s/server/manifests/kata-deploy.yaml
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
content: |
|
||||
apiVersion: helm.cattle.io/v1
|
||||
kind: HelmChart
|
||||
metadata:
|
||||
name: kata-deploy
|
||||
namespace: kube-system
|
||||
spec:
|
||||
chart: {{ kata_chart_url }}
|
||||
targetNamespace: kata-system
|
||||
createNamespace: true
|
||||
timeout: 15m
|
||||
failurePolicy: abort
|
||||
valuesContent: |-
|
||||
deploymentMode: job
|
||||
k8sDistribution: k3s
|
||||
snapshotter:
|
||||
setup: []
|
||||
shims:
|
||||
disableAll: true
|
||||
qemu-runtime-rs:
|
||||
enabled: true
|
||||
runtimeClasses:
|
||||
enabled: true
|
||||
createDefault: true
|
||||
node-feature-discovery:
|
||||
enabled: false
|
||||
|
||||
- name: Wait for the Helm installation job to appear
|
||||
ansible.builtin.command:
|
||||
cmd: k3s kubectl get job/helm-install-kata-deploy -n kube-system
|
||||
register: kata_helm_job
|
||||
retries: 60
|
||||
delay: 2
|
||||
until: kata_helm_job.rc == 0
|
||||
changed_when: false
|
||||
|
||||
- name: Wait for the Helm installation job to finish
|
||||
ansible.builtin.command:
|
||||
cmd: >-
|
||||
k3s kubectl wait --for=condition=complete
|
||||
job/helm-install-kata-deploy -n kube-system --timeout=20m
|
||||
changed_when: false
|
||||
|
||||
- name: Wait for Kata node installation jobs
|
||||
ansible.builtin.shell:
|
||||
cmd: |
|
||||
set -euo pipefail
|
||||
jobs=$(k3s kubectl get jobs -n kata-system -l app.kubernetes.io/instance=kata-deploy -o name)
|
||||
test -n "${jobs}"
|
||||
k3s kubectl wait --for=condition=complete -n kata-system $jobs --timeout=20m
|
||||
executable: /bin/bash
|
||||
changed_when: false
|
||||
|
||||
- name: Wait for the default Kata RuntimeClass
|
||||
ansible.builtin.command:
|
||||
cmd: k3s kubectl get runtimeclass kata
|
||||
register: kata_runtime_class
|
||||
retries: 30
|
||||
delay: 2
|
||||
until: kata_runtime_class.rc == 0
|
||||
changed_when: false
|
||||
@@ -0,0 +1,125 @@
|
||||
---
|
||||
- name: Verify Kata isolation with a disposable Pod
|
||||
hosts: kata-lab
|
||||
gather_facts: false
|
||||
tasks:
|
||||
- name: Remove an earlier smoke Pod
|
||||
ansible.builtin.command:
|
||||
cmd: k3s kubectl delete pod kata-smoke --ignore-not-found --wait=true
|
||||
changed_when: false
|
||||
|
||||
- name: Create the Kata smoke Pod
|
||||
ansible.builtin.shell:
|
||||
cmd: |
|
||||
set -o pipefail
|
||||
k3s kubectl apply -f - <<'EOF'
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: kata-smoke
|
||||
spec:
|
||||
runtimeClassName: kata
|
||||
restartPolicy: Never
|
||||
containers:
|
||||
- name: smoke
|
||||
image: docker.io/library/busybox:1.37
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- 'printf "guest-kernel="; uname -r; test -c /dev/kvm && exit 1 || true'
|
||||
EOF
|
||||
executable: /bin/bash
|
||||
changed_when: true
|
||||
|
||||
- name: Wait for the Kata Pod to finish
|
||||
ansible.builtin.command:
|
||||
cmd: k3s kubectl wait --for=jsonpath='{.status.phase}'=Succeeded pod/kata-smoke --timeout=10m
|
||||
changed_when: false
|
||||
|
||||
- name: Read the guest kernel version
|
||||
ansible.builtin.command:
|
||||
cmd: k3s kubectl logs kata-smoke
|
||||
register: kata_smoke_log
|
||||
changed_when: false
|
||||
|
||||
- name: Read the host kernel version
|
||||
ansible.builtin.command:
|
||||
cmd: uname -r
|
||||
register: kata_host_kernel
|
||||
changed_when: false
|
||||
|
||||
- name: Require a distinct guest kernel
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- kata_smoke_log.stdout is match('^guest-kernel=.+')
|
||||
- kata_smoke_log.stdout | regex_replace('^guest-kernel=', '') != kata_host_kernel.stdout
|
||||
success_msg: >-
|
||||
Kata guest {{ kata_smoke_log.stdout }} differs from host-kernel={{ kata_host_kernel.stdout }}
|
||||
|
||||
- name: Remove an earlier Docker sidecar smoke Pod
|
||||
ansible.builtin.command:
|
||||
cmd: k3s kubectl delete pod kata-docker-smoke --ignore-not-found --wait=true
|
||||
changed_when: false
|
||||
|
||||
- name: Create a Kata Pod with a Docker daemon sidecar
|
||||
ansible.builtin.shell:
|
||||
cmd: |
|
||||
set -o pipefail
|
||||
k3s kubectl apply -f - <<'EOF'
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: kata-docker-smoke
|
||||
spec:
|
||||
runtimeClassName: kata
|
||||
restartPolicy: Never
|
||||
volumes:
|
||||
- name: docker-run
|
||||
emptyDir: {}
|
||||
containers:
|
||||
- name: dockerd
|
||||
image: docker.io/library/docker:27-dind
|
||||
securityContext:
|
||||
privileged: true
|
||||
env:
|
||||
- name: DOCKER_TLS_CERTDIR
|
||||
value: ""
|
||||
volumeMounts:
|
||||
- name: docker-run
|
||||
mountPath: /var/run
|
||||
- name: client
|
||||
image: docker.io/library/docker:27-cli
|
||||
env:
|
||||
- name: DOCKER_HOST
|
||||
value: tcp://127.0.0.1:2375
|
||||
volumeMounts:
|
||||
- name: docker-run
|
||||
mountPath: /var/run
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
until docker info >/dev/null 2>&1; do sleep 1; done
|
||||
docker run --rm docker.io/library/busybox:1.37 echo nested-docker-ok
|
||||
EOF
|
||||
executable: /bin/bash
|
||||
changed_when: true
|
||||
|
||||
- name: Wait for the Docker client to finish
|
||||
ansible.builtin.command:
|
||||
cmd: >-
|
||||
k3s kubectl wait --for=jsonpath='{.status.containerStatuses[?(@.name=="client")].state.terminated.exitCode}'=0
|
||||
pod/kata-docker-smoke --timeout=10m
|
||||
changed_when: false
|
||||
|
||||
- name: Read the Docker client result
|
||||
ansible.builtin.command:
|
||||
cmd: k3s kubectl logs kata-docker-smoke -c client
|
||||
register: kata_docker_smoke_log
|
||||
changed_when: false
|
||||
|
||||
- name: Require Docker to run a nested container
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- "'nested-docker-ok' in kata_docker_smoke_log.stdout"
|
||||
success_msg: Docker daemon sidecar completed a nested container inside the Kata VM
|
||||
Reference in New Issue
Block a user