<p>Sorry if this question might sound &quot;convoluted&quot; but here it goes...</p>
<p>I'm currently designing a k8s solution based on Firecracker and Kata-containers. I'd like the environment to be as isolated/secure as possible. My thoughts around this are:</p>
<ol>
<li>deploy k8s masters as Firecracker nodes having API-server,
Controller, Scheduler and etcd</li>
<li>deploy k8s workers as Firecracker nodes having Kubelet, Kube-proxy and using Kata-containers + Firecracker for
deployed workload. The workload will be a combination of MQTT cluster components and in-house developed FaaS components (probably using OpenFaaS)</li>
</ol>
<p>It's point 2 above which makes me feel a little awkward/convoluted. Am I over complicating things, introducing complexity which will cause problems related to (CNI) networking among worker nodes etc? Isolation and minimizing attack vectors are all important, but maybe I'm trying &quot;to be too much of a s.m.a.r.t.a.s.s&quot; here :)</p>
<p>I really like the concept with Firecrackers microVM architecture with reduced security risks and reduced footprint and it would make for a wonderful solution to tenant isolation. However, am I better of to use another CRI-conforming runtime together with Kata for the actual workload being deployed on the workers?</p>
<p>Many thanks in advance for your thoughts/comments on this!</p>

<p>You might want to take a look at <a href="https://github.com/weaveworks-liquidmetal" rel="nofollow noreferrer">https://github.com/weaveworks-liquidmetal</a> and consider whether contributing to that would get you further towards your goal? alternative runtimes (like kata) for different workloads are welcomed in PR’s. There is a liquid-metal slack channel in the Weaveworks user group of you have any queries. Disclosure I currently work at Weaveworks :)</p>
