Kata containers: support for firecracker by ChillRedChilli · Pull Request #13373 · kubernetes-sigs/kubespray

ChillRedChilli · 2026-07-16T11:57:44Z

What type of PR is this?
/kind feature

What this PR does / why we need it:
This PR introduces support for the Firecracker hypervisor via Kata Containers.

Specifically, this PR:

Adds support for the devmapper snapshotter plugin in the containerd role (required to run Firecracker).
Enables the Firecracker hypervisor configuration in the kata-containers role.
Deploys the kata-fc RuntimeClass manifest.
Adds Molecule tests to validate the firecracker runtime.
Updates Kata Containers role to support downloading the latest release versions, which are distributed as .zst archives.

Which issue(s) this PR fixes:

Special notes for your reviewer:
The containerd devmapper snapshotter plugin requires a secondary block device. I implemented a workaround in roles/container-engine/kata-containers/molecule/default/prepare.yml based on the kata-containers guide for configuring Firecracker.
The workaround creates a 20GB sparse file and binds it to a loop device (/dev/vdb). This simulates the required disk for devmapper during the kata-containers tests.

Does this PR introduce a user-facing change?:

Add support for the Firecracker hypervisor in Kata Containers, the devmapper snapshotter plugin in containerd and update Kata Containers to support new versions.

- Updated download URLs to fetch the kata-static<...>.zst files from github repo. - Added zstd package in kata-continers role. - Updated version checksums to match the new release files.

…ainers - roles/container-engine/containerd: Add support for the devmapper snapshotter plugin (requires a secondary block device) and register the kata-fc runtime. - roles/container-engine/kata-containers: Enable Firecracker hypervisor configuration and add Molecule tests for the kata-fc runtime. - roles/kubernetes-apps/container_runtimes/kata_containers: Add the kata-fc RuntimeClass manifest.

linux-foundation-easycla · 2026-07-16T11:57:50Z

The committers listed above are authorized under a signed CLA.

✅ login: ChillRedChilli / name: Alberto López (af47fcb, c86a315)

kubernetes-prow · 2026-07-16T11:57:53Z

Welcome @ChillRedChilli!

It looks like this is your first PR to kubernetes-sigs/kubespray 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/kubespray has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

kubernetes-prow · 2026-07-16T11:57:53Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ChillRedChilli
Once this PR has been reviewed and has the lgtm label, please assign ant31 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

kubernetes-prow · 2026-07-16T11:57:53Z

Hi @ChillRedChilli. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

ChillRedChilli · 2026-07-17T08:04:46Z

    sampling_ratio = {{ containerd_tracing_sampling_ratio }}
    service_name = "{{ containerd_tracing_service_name }}"
 {% endif %}
+


Containerd's devmapper snapshotter documentation

ChillRedChilli · 2026-07-17T08:06:57Z

Docker docs: Configure direct-lvm mode for production

ChillRedChilli · 2026-07-17T08:09:36Z

Kata-containers: Configure Kata Containers to use Firecracker

ChillRedChilli · 2026-07-17T08:44:49Z

    - container-engine
    - validate-container-engine

+- name: Container Manager


I changed the execution order to run the Container Manager block before the Container runtimes. This is necessary because the kata-containers role (when using Firecracker) depends on containerd being already installed and configured with devmapper.

tico88612 · 2026-07-20T08:48:44Z

We currently don't have CI support for kata containers (we used to, but it might have been disabled because it was failing; I'd prefer to restore that support first).

Otherwise, we won't be able to verify if this feature is working properly.

ChillRedChilli · 2026-07-20T09:15:39Z

@tico88612 I understand completely. Is there an open issue or PR tracking this problem? I'd like to help if possible.

tico88612 · 2026-07-20T09:26:22Z

maybe #10137, however, the CI architecture has changed a lot during this time, so the original code might not work anymore.

ChillRedChilli added 2 commits July 16, 2026 13:20

kata-containers: Update release artifacts to zst format.

af47fcb

- Updated download URLs to fetch the kata-static<...>.zst files from github repo. - Added zstd package in kata-continers role. - Updated version checksums to match the new release files.

kubernetes-prow Bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. kind/feature Categorizes issue or PR as related to a new feature. labels Jul 16, 2026

kubernetes-prow Bot requested review from ErikJiang and yankay July 16, 2026 11:57

kubernetes-prow Bot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jul 16, 2026

kubernetes-prow Bot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Jul 16, 2026

ChillRedChilli commented Jul 17, 2026

View reviewed changes

ChillRedChilli mentioned this pull request Jul 20, 2026

Kata doesn't work on cgroupv2 with kubespray #10137

Open

ChillRedChilli marked this pull request as draft July 21, 2026 16:23

kubernetes-prow Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 21, 2026

Navigation Menu

Uh oh!

Kata containers: support for firecracker - #13373

Kata containers: support for firecracker#13373
ChillRedChilli wants to merge 2 commits into
kubernetes-sigs:masterfrom
ChillRedChilli:kata_containers-support-for-firecracker

ChillRedChilli commented Jul 16, 2026

Uh oh!

linux-foundation-easycla Bot commented Jul 16, 2026 •

edited

Loading

Uh oh!

kubernetes-prow Bot commented Jul 16, 2026

Uh oh!

kubernetes-prow Bot commented Jul 16, 2026

Uh oh!

kubernetes-prow Bot commented Jul 16, 2026

Uh oh!

ChillRedChilli Jul 17, 2026

Uh oh!

ChillRedChilli Jul 17, 2026

Uh oh!

ChillRedChilli Jul 17, 2026

Uh oh!

ChillRedChilli Jul 17, 2026

Uh oh!

tico88612 commented Jul 20, 2026

Uh oh!

ChillRedChilli commented Jul 20, 2026

Uh oh!

tico88612 commented Jul 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

ChillRedChilli commented Jul 16, 2026

Uh oh!

linux-foundation-easycla Bot commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kubernetes-prow Bot commented Jul 16, 2026

Uh oh!

kubernetes-prow Bot commented Jul 16, 2026

Uh oh!

kubernetes-prow Bot commented Jul 16, 2026

Uh oh!

ChillRedChilli Jul 17, 2026

Choose a reason for hiding this comment

Uh oh!

ChillRedChilli Jul 17, 2026

Choose a reason for hiding this comment

Uh oh!

ChillRedChilli Jul 17, 2026

Choose a reason for hiding this comment

Uh oh!

ChillRedChilli Jul 17, 2026

Choose a reason for hiding this comment

Uh oh!

tico88612 commented Jul 20, 2026

Uh oh!

ChillRedChilli commented Jul 20, 2026

Uh oh!

tico88612 commented Jul 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

linux-foundation-easycla Bot commented Jul 16, 2026 •

edited

Loading