Pod VM Ephemeral Storage Isolation via Virtual Disk Union
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Kubernetes systems face security and isolation risks due to shared host OS resources among containers, where a single container can consume all resources and vulnerabilities can spread across containers and control plane components, necessitating improved ephemeral storage management.
Innovation Solution
A virtualized computing system with a host cluster executing a virtualization layer on hardware platforms, supporting pod VMs with a container engine, and an orchestration control plane that integrates a master server with a pod VM controller to manage ephemeral storage using a union of read/write and read-only layers on a virtual disk, ensuring resource isolation and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Use of energy by moving object
If containers share the same host operating system, then resource utilization is improved, but security and isolation are worsened
Solution Approach 1:
The patent segments the host operating system by creating a separate virtual machine (pod VM) for each pod. This segmentation isolates containers from sharing the same OS kernel, preventing security breaches and resource starvation while maintaining efficient resource utilization through virtualization overhead management.
Solution Approach 2:
The patent introduces a virtual machine (pod VM) as an intermediary layer between containers and the host OS. This intermediary provides the necessary isolation and security boundaries while allowing containers to efficiently utilize virtualized resources, resolving the contradiction between resource sharing and security.
2Device complexity
If ephemeral storage is managed within the pod lifecycle, then storage management is simplified, but data accessibility is worsened
Solution Approach 1:
The patent extracts ephemeral storage management from the pod lifecycle by attaching the virtual disk to the pod VM rather than managing it transiently with the pod. This allows storage to be preserved independently of pod termination while maintaining simplified management through the virtualization layer.
Solution Approach 2:
The patent applies partial action by making only the ephemeral storage layer persistent through virtual disk attachment, while keeping the pod lifecycle management simple. This selective persistence allows data accessibility improvement without over-complicating the overall storage management system.
3Adaptability or versatility
If a single container can consume all node resources, then resource allocation flexibility is improved, but system stability is worsened
Solution Approach 1:
The patent segments resource allocation by creating isolated virtual machine boundaries for each pod. This segmentation prevents any single container from consuming all node resources while maintaining flexible resource allocation within each virtualized environment, thus preserving system stability.
Solution Approach 2:
The patent uses virtual machine boundaries as flexible shells that contain and isolate resource consumption. These virtual boundaries provide the necessary constraints to prevent resource starvation while allowing flexible resource distribution across multiple isolated environments.
Data Source
AI summary
A virtualized computing system includes: a host cluster including hosts executing a virtualization layer on hardware platforms thereof, the virtualization layer configured to support execution of virtual machines (VMs), the VMs including a pod VM, the pod VM including a container engine configured to support execution of containers in the pod VM, the pod VM including a first virtual disk attached thereto; and an orchestration control plane integrated with the virtualization layer, the orchestration control plane including a master server in communication with a pod VM controller, the pod VM controller configured to execute in the virtualization layer external to the VMs and cooperate with a pod VM agent in the pod VM, the pod VM agent generating root directories for the containers in the pod VM, each of the root directories comprising a union a read/write ephemeral layer stored on the first virtual disk and a read-only layer.