Set up gVisor on a Kubernetes Cluster

gVisor is an application kernel written in Go that implements a substantial portion of the Linux system call interface. It provides an additional layer of isolation between running applications and the host operating system. gVisor provides a virtualized environment in order to sandbox containers. The system interfaces normally implemented by the host kernel are moved into a distinct, per-sandbox application kernel in order to minimize the risk of a container escape exploit.

Set up gVisor on a Kubernetes Cluster Using GKE Sandbox

1. Set up gVisor on a Kubernetes cluster using GKE sandbox using the steps described in Enabling GKE Sandbox.

2. After all nodes are running correctly, create a Lacework agent and Google microservices.

3. Download lacework-cfg-k8s.yaml and lacework-k8s.yaml files.

4. Use the following steps to create Lacework agent on the cluster:

   1. Download the lacework-cfg-k8s.yaml and lacework-k8s.yaml files.

   2. Update the Daemonset to include proper NodeAffinity and Toleration as follows:

      template:    
          metadata:      
              labels:        
                  name: lacework    
          spec:      
              affinity:        
                  nodeAffinity:          
                      requiredDuringSchedulingIgnoredDuringExecution:            
                          nodeSelectorTerms:              
                              - matchExpressions:                  
                                  - key: sandbox.gke.io/runtime                    
                                    operator: In                    
                                    values:                      
                                      - gvisor      
              tolerations:        
                  - effect: NoSchedule          
                    key: sandbox.gke.io/runtime          
                    operator: Equal          
                    value: gvisor        
                  - key: node-role.kubernetes.io/master          
                    effect: NoSchedule
                  - key: node-role.kubernetes.io/control-plane          
                    effect: NoSchedule

   3. Go to your home directory.

   4. Run sudo mkdir lw cd lw

   5. Create lacework-cfg-k8s.yaml and lacework-k8s.yaml files in the lw directory.

   6. Run these commands to create the Lacework agent:

      1. kubectl create namespace lacework
      2. kubectl create -f lacework-cfg-k8s.yaml -n lacework
      3. kubectl apply -f lacework-k8s.yaml -n lacework
      4. kubectl get ds -n lacework (This command shows the daemonsets created)

   7. The Lacework agent pod is now deployed and should be up and running. To confirm, run this command: kubectl get pods -n lacework -o wide

5. After the Lacework agent pod is running, deploy microservices on the cluster using the steps in Migrating a Monolithic Website to Microservices on Google Kubernetes Engine.

6. Verify your configuration using this command: kubectl get pods

Set up gVisor on a Kubernetes Cluster Using containerd

This section explains how to setup gVisor on a Kubernetes cluster using containerd.

1. Launch any GCP instance (such as an Ubuntu instance).

2. Configure the security group of the GCP instance to allow traffic only to your IP address.

3. Install gCloud on the instance and create a cluster with gCloud.

4. Configure containerd using steps in Containerd Configuration.

5. After successful installation of containerd, configure containerd and update /etc/containerd/config.toml. Ensure containerd-shim-runsc-v1 is in ${PATH} or in the same directory as the containerd binary.

6. After successful setup of containerd, set up Lacework agent and microservices pods.

   1. Go to your home directory
   2. Run these commands:

      sudo mkdir lw
      cd lw
   3. Create lacework-cfg-k8s.yaml and lacework-k8s.yaml files in lw directory.
   4. Run these commands to create the Lacework agent:
      1. kubectl create namespace lacework
      2. kubectl create -f lacework-cfg-k8s.yaml -n lacework
      3. kubectl apply -f lacework-k8s.yaml -n lacework
      4. kubectl get ds -n lacework (This command shows the daemonsets created)
   5. The Lacework agent pod is now deployed and should be up and running. To confirm, run this command: kubectl get pods -n lacework -o wide.

7. After the Lacework pod is running, deploy microservices on the cluster.

8. Verify your configuration using this command: kubectl get pods