Deploying Secure Firecracker MicroVMs on K8s using Weave FireKube
Tags: docker, kubernetes, security
Published: 2020-06-07 16:04:01

#Introduction#

At their 2018 annual Re:Invent conference, AWS announced an exciting new product called "Firecracker" that is quickly setting the cloud-native ecosystem on fire. Firecracker is a [Virtual Machine Manager](https://github.com/firecracker-microvm) (VMM) exclusively designed for running transient and short-lived processes. In other words, it is optimized for running functions and serverless workloads that require faster cold start and higher density. 

Using the same technology that Amazon uses for AWS Lambda and AWS Fargate, Firecracker delivers the speed of containers with the security of VMs and has the potential to disrupt the current container and serverless technologies.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/z92wbayo3s1qwl5l0ztm.png)

#What is Weave Ignite?#

While Firecracker has a ton of potential, it's still in its early stages so getting it up and running can be a bit tedious. The goal of **Ignite** is to solve this issue by adopting its developer experience from *containers*. 

With Ignite, you just pick a container image that you want to run as a VM and then execute `ignite run` instead of `docker run`. 

There’s no need to use VM-specific tools to build `.vdi`, `.vmdk`, or `.qcow2` images, just do a `docker build` from any base image you want (e.g. `ubuntu:18.04` from Docker Hub), and add your preferred content. 

You can even use Buildpacks! As seen in my other blog post [here](https://appfleet.com/blog/using-buildpacks-to-provision-oci/). In this case, you would just follow the same steps, except you would build the image via the `pack` command. 

#What is Firekube?#

Firekube is a new open-source Kubernetes distribution that enables the use of Weave Ignite and GitOps to enable the setup of secure VM clusters. Firekube pulls everything from Git, detects your operating system and can boot up a secure cluster of VMs from nothing in 2.5 minutes.

A Firekube cluster has the following properties:

1. Runs Kubernetes (now K8s, possibly K3s in future)
2. High-grade VM security via the Firecracker KVM isolation
3. Fast start-up and tear down of VMs e.g. for functions and serverless apps
4. Scales from zero to production - uses standard k8s plugins for networking, etc
5. “Lift and shift” software into VMs
6. Run containers inside VMs or alongside VMs on the same CNI network

#Creating a Firekube Cluster#

Firekube is a Kubernetes cluster working on top of [Ignite](https://github.com/weaveworks/ignite) and [Firecracker](https://github.com/firecracker-microvm/firecracker). Firekube clusters are operated with [GitOps](https://www.weave.works/technologies/gitops/).

[Ignite](https://github.com/weaveworks/ignite) and [Firecracker](https://github.com/firecracker-microvm/firecracker) only works on Linux as they need [KVM](https://en.wikipedia.org/wiki/Kernel-based_Virtual_Machine). However, it will also work on macOS using [footloose](https://github.com/weaveworks/footloose): the Kubernetes nodes are then running inside containers.

**Prerequisites**: Docker, Git, [kubectl 1.14+](https://v1-14.docs.kubernetes.io/docs/tasks/tools/install-kubectl/).

1. Fork this repository.
2. Clone your fork and `cd` into it. Use the `SSH` git URL as the script will push an initial commit to your fork:

```
export user="" # Your GitHub handle or org

git clone git@github.com:$user/wks-quickstart-firekube.git
cd wks-quickstart-firekube
```

3.Start the cluster:

```
./setup.sh
```

This step will take several minutes.

Export the `KUBECONFIG` environment variable as indicated at the end of the installation:

```
export KUBECONFIG=/home/damien/.wks/weavek8sops/example/kubeconfig
```

Enjoy your Kubernetes cluster!

```
$ kubectl get nodes
NAME               STATUS   ROLES    AGE     VERSION
67bb6c4812b19ce4   Ready    master   3m42s   v1.14.1
a5cf619fa058882d   Ready    <none>   75s     v1.14.1
```

#Watch GitOps in action#

Now that we have a cluster installed, we can commit Kubernetes objects to the git repository and have them appear in the cluster. Let's add [podinfo](https://github.com/stefanprodan/podinfo), an example Go microservice, to the cluster.

```
kubectl apply --dry-run -k github.com/stefanprodan/podinfo//kustomize -o yaml > podinfo.yaml
git add podinfo.yaml
git commit -a -m 'Add podinfo Deployment'
git push
```

A few seconds later, you should witness the apparition of a podinfo pod in the cluster:

```
$ kubectl get pods
NAME                       READY   STATUS    RESTARTS   AGE
podinfo-677768c755-z76xk   1/1     Running   0          30s
```

To view `podinfo` web UI:

1.Expose `podinfo` locally:

```
kubectl port-forward deploy/podinfo 9898:9898
```

2.Point your browser to `http://127.0.0.1:9898`:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/krzy14syys1li9ux1we3.png)

#Deleting a Firekube cluster#

Run:

```
./cleanup.sh
```

#Using a private git repository with firekube#

To use a private git repository instead of a fork of `wks-quickstart-firekube`:

1.Create a private repository and push the `wks-quickstart-firekube` `master` branch there. Use the SSH git URL when cloning the private repository:

```
git clone git@github.com:$user/$repository.git
cd $repository
git remote add quickstart git@github.com:weaveworks/wks-quickstart-firekube.git
git fetch quickstart
git merge quickstart/master
git push
```

2.Create an SSH key pair:

```
ssh-keygen -t rsa -b 4096 -C "damien+firekube@weave.works" -f deploy-firekube  -N ""
```

3.Upload the deploy key to your private repository (with read/write access):

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/ouwceib51027ufb7yl6r.png)

4.Start the cluster:

```
./setup.sh --git-deploy-key  ./deploy-firekube
```

#Final thoughts#

You've now learned the basic steps it requires to provision a Kubernetes cluster based on Firecracker VM's with Firekube. You should explore a bit of the different options the platform provides such as using Ignite to spin up MicroVM's with Buildpack instead of Docker.