The power of KubeVirt and Calico

Virtualization is a powerful technology that allows businesses to run multiple operating systems and applications on a single physical server. KubeVirt is an open-source tool that makes it easy to deploy and manage virtual machines (VMs) on Kubernetes and Calico is an open-source networking and security tool that provides easy yet robust networking and security for Kubernetes workloads. In this blog post, we will explore the benefits of using KubeVirt and Calico together, including how to create and manage VMs, configure networking and security, and enable advanced use cases such as multi-network interfaces.

An example to configure and try out KubeVirt and Calico can be found in this Github repo.

Introduction to KubeVirt and Calico

KubeVirt, an open-source project, extends Kubernetes’ capabilities to virtual machine management, enabling the orchestration and management of VMs alongside containers within a single platform. On the other hand, Calico, another open-source project, provides powerful networking and network policy enforcement for Kubernetes environments, ensuring secure and reliable communication between pods, services, and VMs.

KubeVirt extends the capabilities of Kubernetes to support the deployment, management, and scaling of VMs alongside containerized applications. By leveraging Kubernetes’ resource management, load balancing, and orchestration features, KubeVirt enables seamless integration of VMs into modern cloud-native infrastructures.

Calico, on the other hand, offers robust networking and security features for Kubernetes environments. It provides complete Layer 3 networking, including IP address management, routing, and policy enforcement. Additionally, Calico’s rich set of security features, such as network policies, encryption, and zero-trust access, ensures that VMs and containers communicate securely within the Kubernetes cluster.

The combination of KubeVirt and Calico brings forth a multitude of benefits, making it an ideal choice for organizations seeking to modernize their infrastructure. First and foremost, it streamlines VM management by leveraging Kubernetes’ powerful orchestration capabilities. With KubeVirt, admins can provision, scale, and update VMs using the familiar Kubernetes APIs and tools, resulting in simplified operations and improved resource utilization. Additionally, Calico’s seamless integration with KubeVirt ensures consistent networking policies for both containers and VMs, eliminating the need for complex configuration and reducing the risk of security vulnerabilities.

Joint solution enables the deployment of VMs across different cloud environments, including public clouds, private clouds, and hybrid cloud setups, providing the freedom to choose the most suitable infrastructure for specific workloads. By abstracting away the underlying infrastructure, organizations gain the ability to easily migrate VMs between different environments without significant disruptions, enhancing agility and reducing vendor lock-in.

Benefits of Using KubeVirt and Calico Together

Using KubeVirt on top of Calico offers several compelling benefits for managing VMs in Kubernetes environments. Here are some of the key advantages:

• Manageability: KubeVirt seamlessly integrates with Kubernetes, allowing developers and administrators to manage both VMs and containers using the familiar Kubernetes APIs and tools. This unified management approach simplifies operations and reduces the learning curve for working with VMs in a Kubernetes environment.
• Enhanced Scalability: KubeVirt and Calico together enable horizontal scaling of VMs, allowing organizations to easily adjust VM resources based on demand. This flexibility is crucial for handling fluctuating workloads and optimizing resource utilization.
• Robust Security: Calico provides advanced security features that extend to VMs managed by KubeVirt. Network policies, encryption, and access control mechanisms ensure secure communication between VMs and containers, enhancing the overall security posture of the Kubernetes environment.
• Advanced Networking: Calico’s networking capabilities, including multi-tenancy, choice of a networking data plane (Iptables, eBPF, VPP, Windows), advanced IP management, Egress Gateways, enable efficient network management for VMs and containers within the Kubernetes cluster. This fosters seamless communication and ensures optimal network performance.
• Cost Optimization: By utilizing KubeVirt and Calico, organizations can run VMs and containers on a shared infrastructure, avoiding the need for separate VM management tools and networking solutions. This consolidation reduces licensing and operational costs, resulting in significant cost savings.

Creating and Managing Virtual Machines with KubeVirt

To create a VMI with KubeVirt, users can define a VirtualMachine object, specifying VM details like the desired operating system, hardware resources, and network interfaces. KubeVirt takes care of the underlying VM setup, including resource allocation and boot processes. Users can conveniently use the Kubernetes API or the kubectl command-line tool to easily manage VMIs, including operations such as starting, stopping, pausing, and deleting. For monitoring VM health and performance, KubeVirt provides insightful metrics and logs, which can be readily integrated into existing monitoring systems.

Example manifest for KubeVirt Ubuntu VM:

apiVersion: kubevirt.io/v1
kind: VirtualMachine
metadata:
 name: ubuntu-vm
spec:
 running: false
 template:
   metadata:
     labels:
       kubevirt.io/size: small
       kubevirt.io/domain: ubuntu-vm
   spec:
     domain:
       cpu:
         cores: 2
       devices:
         disks:
           - name: containerdisk
             disk:
               bus: virtio
           - name: cloudinitdisk
             disk:
               bus: virtio
         interfaces:
         - name: default
           masquerade: {}
       resources:
         requests:
           memory: 4096Mi
     networks:
     - name: default
       pod: {}
     volumes:
       - name: containerdisk
         containerDisk:
           image: tedezed/ubuntu-container-disk:22.0
       - name: cloudinitdisk
         cloudInitNoCloud:
           userDataBase64: ${CLOUDINIT}
---

Beyond the core VM functionality, KubeVirt offers advanced features such as live migration, allowing VMs to be moved between hosts without disrupting ongoing operations. With live migration, applications can undergo maintenance and upgrades without experiencing any downtime. Additionally, KubeVirt provides support for snapshots, enabling users to easily create backups and restore VMIs to previous states. Through these capabilities, KubeVirt simplifies VM management and ensures application availability and data protection within the Kubernetes environment.

Managing storage for VMs in KubeVirt can be achieved through persistent volume claims. Similar to how persistent volumes are used to provide persistent storage for containers, persistent volume claims can be created and attached to VMIs to ensure persistent storage for data and applications running within the VM. These persistent volume claims can leverage various storage backends supported by Kubernetes, including cloud providers and on-premise storage systems.

Overall, KubeVirt empowers users with the ability to seamlessly create, manage, and scale VM workloads alongside container-based applications within the familiar Kubernetes ecosystem. Its integration with Kubernetes simplifies the management of virtual infrastructure and provides a consistent experience across both containers and VMs, enabling organizations to leverage the benefits of both technologies.

Networking and Security with Calico

In addition to KubeVirt’s capabilities, Calico plays a vital role in providing robust networking and security for virtual machines within a Kubernetes environment. Calico’s networking provides sophisticated IP address management (IPAM) capabilities. Calico automatically assigns IP addresses to virtual machines, eliminating the need for time-consuming manual configurations. While Calico can provide its own robust IPAM capabilities, it can also be used “in-chain” with another IPAM solution, such as AKS/EKS/GKE container networking interface (CNI).

Calico’s policy engine provides control over network traffic, enabling administrators to define granular rules and enforce them across the entire virtual infrastructure. It supports a range of networking policies, including network policies for pods and KubeVirt VMs, service policies for exposing services, and global policies for global network-level configuration. Calico’s network policies enable administrators to define fine-grained rules for controlling network traffic between pods, services, and virtual machines. This level of control empowers organizations to implement robust security measures and ensure compliance with industry standards and regulations. In addition to Calico’s robust policy engine, it provides WireGuard encryption, ensuring the confidentiality and integrity of network communications between virtual machines.

Calico’s integration with KubeVirt is seamless and transparent. When deployed alongside KubeVirt, Calico automatically provisions and manages the necessary network components for virtual machines. This simplified setup process minimizes the administrative overhead associated with networking configuration, enabling organizations to focus on their core business objectives. Moreover, Calico leverages Kubernetes primitives for policy management, allowing administrators to use familiar Kubernetes concepts and tools to define networking and security policies for both containers and virtual machines. This consistent policy management experience further enhances operational efficiency and simplifies the management of heterogeneous workloads within a single platform.

The image below shows how standard Kubernetes and Calico policies can be used to control access to KubeVirt VMs.

Advanced Networking Capabilities and Use Cases

Calico is not just limited to basic networking and security features. Calico Enterprise and Calico Cloud, the commercial editions of Calico, offer advanced networking and security capabilities for virtual machines within KubeVirt and secure Kubernetes workloads. For instance, Calico Enterprise provides support for multiple network interfaces per VM/pod, enabling more complex networking scenarios. This capability can be particularly useful for VMs that require specialized network configurations or that need to interact with external systems via a specific interface.

Calico also provides a stable IP for namespaces or specific workloads, also known as Egress Gateways. While CNI assigns an IP to a VM or a pod running in Kubernetes environment, that IP cannot be used as a reliable identity as it may change if the pod/VM churns or a workload scales to multiple instances which will result in multiple IPs representing the same workload. The Egress Gateway allows the configuration of a stable known IP(s) associated with an entire Kuberentes namespace or a specific workload. Moreover, Egress Gateway Policies allow controlling which Egress Gateway instance is used depending on where the packet is headed.

Managing Heterogenous and Homogenous Kubernetes environments

Using Calico with KubeVirt allows platform teams to choose the best suited architecture to run cloud-native containerized applications and VMs.

To simplify management overhead a team may choose to host both cloud-native applications and KubeVirt VMs within the same Kubernetes environment. This approach simplifies operational costs as it allows teams to leverage the same pipeline for deploying, managing, and securing cloud-native applications and VMs.

If there is a clear separation of responsibilities of which team manages VMs vs which team manages cloud-native applications and they need to use separate Kubernetes environments, Calico can facilitate a seamless connectivity between such clusters leveraging Cluster Mesh capability.

Conclusion

In summary, the combination of KubeVirt and Calico not only provides a solid foundation for running and managing virtual machines in a Kubernetes environment, but also offers advanced features that cater to more demanding and diverse use cases. By leveraging Calico Enterprise and the support for multiple network interfaces in KubeVirt, organizations can unlock a new level of virtualization capabilities, enhancing the flexibility, connectivity, and networking control of their virtual machines within Kubernetes. Such a combination offers companies that rely on VMs to run their workloads an alternative solution to a traditional VMWare virtualization option.

Ready to try Calico network policies? Sign up for a free trial of Calico Cloud.