OpenShift Virtualization

1
 Gartner predicts that, by 2022, more than
75% of global organizations will be running
containerized applications in production,
which is a significant increase from fewer than
30% in 2019.

Gartner, Assessing Kubernetes for Hybrid and

Multicloud Application Portability, June 2020.

2
 The move from Virtual Machines to Containers
Accelerate Digital Transformations Increase Operational Efficiency and Standardization

Traditional virtualization cannot support these cloud-native

Improve Developer Productivity applications.

Co-existence between legacy and cloud-native

Most are
Cloud Native here

Environments

Time
Legacy VM
Environments

New and legacy apps co-existing

 OpenShift and Kubernetes crossing to early majority in IT adoption
Two emerging trends

1. Need for a better modernization 2. Desire for a single architecture for

strategy for virtual machine all workloads
(VM)-based workloads

An all-or-nothing approach to Kubernetes supports stateful

containerization is too slow, so applications, and organizations desire
organizations have a large investment to reduce costs by adopting a single
in virtual machines. cloud-native platform.

4
 What is OpenShift
Virtualization?

5
 Containers are not virtual machines
● Containers are process isolation
● Kernel namespaces provide isolation and
cgroups provide resource controls App 1 App 2 App 3

● No hypervisor needed for containers Guest Guest Guest

● Contain only binaries, libraries, and tools OS OS OS

App 1 App 2 App 3

which are needed by the application
Hypervisor Operating System
● Ephemeral
Infrastructure Infrastructure

Virtualization Containerization

6
 Virtual machines can be put into containers
● A KVM virtual machine is a process
● Containers encapsulate processes
● Both have the same underlying
resource needs:
○ Compute
○ Network
○ (sometimes) Storage

7
 KubeVirt becomes a CNCF FOR INTERNAL USE ONLY

incubating project - April 2022

30 337 133
Releases (since Sandbox) Contributors Contributing Companies

“KubeVirt collaborates and integrates with many other Cloud Native projects. Foremost with

building on top of and aligning with Kubernetes and its principles to provide a consistent user

experience. KubeVirt is built to be complemented by other projects to extend its feature set:

Storage (Rook), Observability & Alerting (Prometheus), L2 Networking (Multus, Kube-OVN),

Service Meshes (Istio), Automation (Tekton, ArgoCD), and workload migration (Konveyor).”
8

ttps://www.cncf.io/blog/2022/04/19/kubevirt-becomes-a-cncf-incubating-project/
h
 OpenShift Virtualization
● Virtual machines
○ Running in containers, managed as Pods
○ Using the KVM hypervisor
● Scheduled, deployed, and managed by Kubernetes
● Integrated with container orchestrator resources and
services
○ Traditional Pod-like SDN connectivity and/or
connectivity to external VLAN and other networks
via multus
○ Persistent storage paradigm (PVC, PV,
StorageClass)

9
 VM containers use KVM
● OpenShift Virtualization uses KVM, the Linux kernel
hypervisor
● KVM is a core component of the Red Hat Enterprise
Linux kernel OTHER APPS libvirt
QEMU
○ KVM has 10+ years of production use: Red Hat
Virtualization, Red Hat OpenStack Platform, and RHCOS
RHEL all leverage KVM, QEMU, and libvirt KVM

● QEMU uses KVM to execute virtual machines DRIVER DRIVER DRIVER

● libvirt provides a management abstraction layer

CPU/RAM STORAGE NETWORK

HARDWARE

10
 Built with
Kubernetes

11
 Virtual machines in a container world
● Provides a way to transition application components
which can’t be directly containerized into a Kubernetes
system
○ Integrates directly into existing k8s clusters
○ Follows Kubernetes paradigms:
VM pod App pod
■ Container Networking Interface (CNI)
■ Container Storage Interface (CSI)
OpenShift
■ Custom Resource Definitions (CRD, CR)
● Schedule, connect, and consume VM resources as
RHEL CoreOS
container-native

Physical Machine

12
 Virtualization native to Kubernetes
● Operators are a Kubernetes-native way to introduce
new capabilities
● New CustomResourceDefinitions (CRDs) for native
VM integration, for example:
○ VirtualMachine
○ VirtualMachineInstance
○ VirtualMachineInstanceMigration
○ VirtualMachineSnapshot
○ DataVolume

13
 Containerizing KVM
Trusted, mature KVM wrapped in modern management and automation

Red Hat Virtualization OpenShift Virtualization Red Hat OpenStack Platform

RHV-M Console / CLI OpenShift Console / CLI OpenStack Horizon / CLI

vdsm kubelet nova-compute

libvirt libvirt libvirt

QEMU / KVM QEMU / KVM QEMU / KVM

VM VM VM
libvirt Security Kubernetes Security libvirt Security

RHV Host RHEL CoreOS Host OSP Compute

 Using VMs and containers together
● Virtual machines connected to pod networks
are accessible using standard Kubernetes
methods:
○ Service
○ Route
○ Ingress
● Network policies apply to VM pods the same
as application pods
● VM-to-pod, and vice-versa, communication
happens over SDN or ingress depending on
network connectivity

15
 Comparing with
traditional
virtualization
platforms

16
 Live Migration
● Live migration moves a virtual machine from one node to another in the OpenShift cluster
● Can be triggered via GUI, CLI, API, or automatically
● RWX storage is required
● Live migration is cancellable by deleting the API object
● Default maximum of five (5) simultaneous live migrations
○ Maximum of two (2) outbound migrations per node, 64MiB/s throughput each

Migration Reason vSphere OpenShift Virtualization

Resource contention DRS Pod eviction policy, pod

descheduler

Node maintenance Maintenance mode Maintenance mode, node drain

17
 Automated live migration
● OpenShift / Kubernetes triggers Pod rebalance actions based on multiple factors
○ Soft / hard eviction policies
○ Pod descheduler
○ Pod disruption policy
○ Node resource contention resulting in evictions
■ Pods are Burstable QoS class by default
■ All memory is requested in Pod definition, only CPU overhead is requested
● Pod rebalance applies to VM pods equally
● VMs will behave according to the eviction strategy
○ LiveMigrate - use live migration to move the VM to a different node
○ No definition - terminate the VM if the node is drained or Pod evicted

18
 VM scheduling
● VM scheduling follows pod scheduling rules
○ Node selectors
○ Taints / tolerations
○ Pod and node affinity / anti-affinity
● Kubernetes scheduler takes into account many additional factors
○ Resource load balancing - requests and reservations
○ Large / Huge page support for VM memory
○ Use scheduler profiles to provide additional hints (for all Pods)
● Resources are managed by Kubernetes
○ CPU and RAM requests less than limit - Burstable QoS by default
○ K8s QoS policy determines scheduling priority: BestEffort class is evicted before
Burstable class, which is evicted before Guaranteed class
19
 Node Resource Management
● VM density is determined by multiple factors controlled at the cluster, OpenShift Virtualization,
Pod, and VM levels
● Pod QoS policy
○ Burstable (limit > request) allows more overcommit, but may lead to more frequent
migrations
○ Guaranteed (limit = request) allows less overcommitment, but may have less physical resource
utilization on the hosts
● Cluster Resource Override Operator provides global overcommit policy, can be customized per
project for additional control
● Pods request full amount of VM memory and approx. 10% of VM CPU
○ VM pods request a small amount of additional memory, used for libvirt/QEMU overhead
■ Administrator can set this to be overcommitted
20
 High availability
● Node failure is detected by Kubernetes and results in the Pods from the lost node being
rescheduled to the surviving nodes
● VMs are not scheduled to nodes which have not had a heartbeat from virt-handler, regardless of
Kubernetes node state
● Additional monitoring may trigger automated action to force stop the VM pods, resulting in
rescheduling
○ May take up to 5 minutes for virt-handler and/or Kubernetes to detect failure
○ Liveness and Readiness probes may be configured for VM-hosted applications
○ Machine health checks can decrease failure detection time

21
 Terminology comparison
Feature RHV OpenShift Virtualization vSphere

Where VM disks are stored Storage Domain PVC datastore

Policy based storage None StorageClass SPBM

Non-disruptive VM Live migration Live migration vMotion

migration

Non-disruptive VM storage Storage live migration N/A Storage vMotion

migration

Active resource balancing Cluster scheduling policy Pod eviction policy, descheduler Dynamic Resource
Scheduling (DRS)

Physical network Host network config (via nmstate Operator, Multus vSwitch / DvSwitch
configuration nmstate w/4.4)

Overlay network OVN OCP SDN (OpenShiftSDN, NSX-T

configuration OVNKubernetes, and partners),
Multus

Host / VM metrics Data warehouse + OpenShift Metrics, health checks vCenter, vROps
Grafana (RHV 4.4)
22
 Runtime
awareness

23
 Compute configuration
● VM nodes should be physical with CPU virtualization technology enabled in the BIOS
○ Nested virtualization works, but is not supported
○ Emulation works, but is not supported (and is extremely slow)
● Node labeler detects CPU type and labels nodes for compatibility and scheduling
● Configure overcommitment using native OpenShift functionality - Cluster Resource Override
Operator
○ Optionally, customize the project template so that non-VM pods are not overcommitted
○ Customize projects hosting VMs for overcommit policy
● Apply Quota and LimitRange controls to projects with VMs to manage resource consumption
● VM definitions default to all memory “reserved” via a request, but only a small amount of CPU
○ CPU and memory request/limit values are modified in the VM definition

24
 Storage configuration
● Shared storage is not required, but very highly encouraged
○ Live migration depends on RWX PVCs
● Create shared storage from local resources using OpenShift Container Storage
○ RWX file and block devices for live migration
● No preference for storage protocol, use what works best for the application(s)
● Storage backing PVs should provide adequate performance for VM workload
○ Monitor latency from within VM, monitor throughput from OpenShift
● For IP storage (NFS, iSCSI), consider using dedicated network interfaces
○ Will be used for all PVs, not just VM PVs
● Certified CSI drivers are recommended
○ Many non-certified CSI provisioners work, but do not have same level of OpenShift testing
● Local storage may be utilized via the Host Path Provisioner
25
 Customer Use
Cases

26
 Who’s using OpenShift Virtualization

Large web retailer in EMEA

Online platform for real estate, cars and a broad variety of goods and services.

• 4th most visited site in region (After GOOG, FB, YT)

• Aggressive deployment of OpenShift &
OpenShift Data Foundation in 6 months to production

• Modernize existing infrastructure &

VM apps to containers
• Innovative technology to attract & retain IT talent

• Currently running 1400 VMs on ~ 60 hosts

• Deploying second data center for DR

27
 Who’s using OpenShift Virtualization

Global Telecommunications/5G Provider

▸ OpenShift Virtualization can be used as a transitional

technology for workloads not yet ready for containers.
▸ Architect, develop, test, and scale production-like deployments
many months before a containerized version of applications
being available.
･ MySQL Cluster Carrier Grade Edition from Oracle

･ F5 BIG-IP , initially deployed as VM, refactoring to a container

▸ Significantly accelerate time to market,

while ensuring reliability and quality of the overall solution.

28
MIGRATION TOOLKIT FOR VIRTUALIZATION

Migration Toolkit for Virtualization (MTV)

Migration at scale of virtual machines to OpenShift

Migration Analytics
Detect potential compatibility issues before
migrating to ensure a successful migration

Mass Migration of VMs

Migrate workloads at scale to OpenShift
● Provide source and destination credentials
● Map infrastructure
● Create migration plans
 Thank you linkedin.com/company/red-hat

youtube.com/user/RedHatVideos
Red Hat is the world’s leading provider of enterprise

open source software solutions. Award-winning

facebook.com/redhatinc
support, training, and consulting services make

Red Hat a trusted adviser to the Fortune 500.

twitter.com/RedHat

30