katadocker/kata-webhook-example repository overview

⁠Kata Admission controller webhook

Implement a simple admission controller webhook to annotate pods with the Kata runtime class.

⁠How to build the admission controller

First build the admission controller image and the associated Kubernetes YAML files required to instantiate the admission controller.

$ docker build -t katadocker/kata-webhook-example:latest .
$ ./create_certs.sh

⁠Making Kata the default runtime using an admission controller

Today in crio.conf runc is the default runtime when a user does not specify runtimeClass in the pod spec. If you want to run a cluster where Kata is used by default, except for workloads we know for sure will not work with Kata, use the admission webhook⁠ and sample admission controller we created by running

$ kubectl apply -f deploy/

The webhook mutates pods to use the Kata runtime class for all pods except those with

• hostNetwork: true
• namespace: rook-ceph and rook-ceph-system