Hacker News Reader

Comment by Klasiaster | Hacker News Reader

It's quite light on details: What properties does the (virtualized) ARM CPU that one gets have? Can it do KVM itself (meaning the underlying real CPU has support for nested KVM)? Can it do ARMv8.3 pointer authentication?

View on HN

It's an Ampere Altra for those first instances. So no on both.

They could have named Ampere and give credit to them, I think it's common in cloud instance offerings to have AMD or Intel also being named as underlying physical CPUs, even with the generation.

They did in the docs, 2nd paragraph of the blog post, etc

https://cloud.google.com/blog/products/compute/tau-t2a-is-fi...

Thanks, yes, makes sense to look at the GCE announcement instead of the GKE announcement for this info.

I'd be curious to hear what the use case is for nested KVM. What hardware support is required for that as well?

The instance exposed by GCE is virtualized. If you want to run any hw virtualized workload inside it, you need nested virtualization.

I'd be curious to hear more about your Kubernetes workloads. What virtualized hardware do your pods require?

Any untrusted workloads (say CI runners running your clients arbitrary code) better be run inside kata containers so you can’t use t2a vms for that

In GKE you can just enable GKE Sandbox/gVisor on a node pool to run your untrusted workloads. gVisor serves the same purpose as Kata containers.

Yes except slow io

Can you elaborate? What type of I/O, network, disk? What is the issue exactly?

You can refer to gvisor performance docs - https://gvisor.dev/docs/architecture_guide/performance/#file... throughput is really terrible, same deal with networking and also if your userland issues a lot of syscalls

Thanks for the link. I'm curious, how is the I/O performance with Kata? Does it use VirtIO?

It does and I believe with dax (if your kernel has it) it’s basically same speed as regular runc. 9p is still default tho i think

Reply on news.ycombinator.com