IMP

Appearance

Day 0: Install and Baseline ​

Goals ​

  • Install the operator and agent.
  • Verify the control plane and data plane are Ready.
  • Configure logging and Prometheus scraping.

Prerequisites ​

  • Kubernetes cluster with /dev/kvm on target nodes
  • kubectl, helm, cluster-admin context (pin via --context; see Day 1)
  • Nodes labeled imp/enabled=true

Privileged Namespace ​

Imp's agent is privileged (mounts /dev/kvm, Firecracker binaries, guest kernel paths). Isolate it:

bash
kubectl create namespace imp-system --dry-run=client -o yaml | kubectl apply -f -
kubectl label namespace imp-system \
  pod-security.kubernetes.io/enforce=privileged \
  pod-security.kubernetes.io/audit=privileged \
  pod-security.kubernetes.io/warn=privileged \
  --overwrite

Keep imp-system as the only namespace with privileged. All other namespaces stay restricted unless independently justified. Do not relax Pod Security Admission cluster-wide.

Node Selector imp/enabled=true ​

The chart defaults both agent.nodeSelector and kvm.preflight.nodeSelector to imp/enabled=true. This label is the explicit opt-in for the scheduler and the privileged agent.

bash
# Label the nodes that may run IMP
kubectl label node <node-name> imp/enabled=true --overwrite
kubectl get nodes -l imp/enabled=true

# Verify chart values still require it
helm get values imp -n imp-system | grep -A2 nodeSelector

When adding placement constraints, keep imp/enabled=true as a required selector. Do not replace it.

Install ​

bash
helm upgrade --install imp ./charts/imp -n imp-system --create-namespace
kubectl -n imp-system get pods

Image Digest Pin ​

Pin images by digest in production values and verify before promotion:

yaml
# values-production.yaml
operator:
  image:
    digest: sha256:<operator-digest>
agent:
  image:
    digest: sha256:<agent-digest>
bash
helm upgrade --install imp ./charts/imp \
  -n imp-system -f values-production.yaml

Also pin Firecracker, Jailer, guest-kernel, and rootfs artifact provenance.

Runtime OnDelete ​

imp-runtime DaemonSet uses updateStrategy: OnDelete. It never rolls or drains automatically.

To roll the runtime:

bash
kubectl cordon <node>
kubectl drain <node> --ignore-daemonsets --delete-emptydir-data
kubectl -n imp-system delete pod -l app.kubernetes.io/name=imp-runtime --field-selector spec.nodeName=<node>
kubectl uncordon <node>

Or delete the pod directly if cordon/drain is handled externally. The DaemonSet controller recreates the pod with the new spec. Do not expect a rolling update.

pressureLifecycle Opt-In ​

pressureLifecycle.enabled is false by default. When enabled, the operator suspends the largest resident ImpVMs first on nodes reporting MemoryPressure. It never auto-resumes; an operator must resume each VM.

yaml
pressureLifecycle:
  enabled: true

Enable only if your runbook covers manual resume and you monitor kubelet pressure conditions.

Checklist ​

  1. Install CRDs and controller manifests.
  2. Deploy agent DaemonSet to target nodes (verify imp/enabled=true coverage).
  3. Apply privileged imp-system namespace policy.
  4. Confirm controller and agent pods are healthy.
  5. Apply a minimal ImpVM sample and verify lifecycle.
  6. Document digest pins and OnDelete rollout procedure.

Validation Steps ​

  • kubectl get crd | grep imp
  • kubectl get nodes -l imp/enabled=true
  • kubectl -n imp-system get pods
  • kubectl -n imp-system get ds imp-runtime -o yaml | grep -A2 updateStrategy
  • kubectl get events -A --sort-by=.lastTimestamp | tail -n 50
  • kubectl get impvm -A -o wide

Baseline Controls ​

  • Pin image versions (digest) for repeatable rollouts.
  • Define resource quotas and namespace boundaries.
  • Configure log retention and metric scraping.
  • Document rollback path before production rollout.