3 [Kata Containers](https://katacontainers.io) is a secure container runtime with lightweight virtual machines that supports multiple hypervisor solutions.
7 _Qemu_ is the only hypervisor supported by Kubespray.
11 To enable Kata Containers, set the following variables:
16 container_manager: containerd
17 kata_containers_enabled: true
23 etcd_deployment_type: host
28 By default, runc is used for pods.
29 Kubespray generates the runtimeClass kata-qemu, and it is necessary to specify it as
30 the runtimeClassName of a pod spec to use Kata Containers:
33 $ kubectl get runtimeclass
35 kata-qemu kata-qemu 3m34s
43 runtimeClassName: kata-qemu
48 $ kubectl apply -f nginx.yaml
53 ### Recommended : Pod Overhead
55 [Pod Overhead](https://kubernetes.io/docs/concepts/configuration/pod-overhead/) is a feature for accounting for the resources consumed by the Runtime Class used by the Pod.
57 When this feature is enabled, Kubernetes will count the fixed amount of CPU and memory set in the configuration as used by the virtual machine and not by the containers running in the Pod.
59 Pod Overhead is mandatory if you run Pods with Kata Containers that use [resources limits](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits).
61 **Set cgroup driver**:
63 To enable Pod Overhead feature you have to configure Kubelet with the appropriate cgroup driver, using the following configuration:
65 `cgroupfs` works best:
68 kubelet_cgroup_driver: cgroupfs
71 ... but when using `cgroups v2` (see <https://www.redhat.com/en/blog/world-domination-cgroups-rhel-8-welcome-cgroups-v2>) you can use systemd as well:
74 kubelet_cgroup_driver: systemd
77 **Qemu hypervisor configuration**:
79 The configuration for the Qemu hypervisor uses the following values:
82 kata_containers_qemu_overhead: true
83 kata_containers_qemu_overhead_fixed_cpu: 10m
84 kata_containers_qemu_overhead_fixed_memory: 290Mi
87 ### Optional : Select Kata Containers version
89 Optionally you can select the Kata Containers release version to be installed. The available releases are published in [GitHub](https://github.com/kata-containers/kata-containers/releases).
92 kata_containers_version: 2.2.2
97 Debug is disabled by default for all the components of Kata Containers. You can change this behaviour with the following configuration:
100 kata_containers_qemu_debug: 'false'