Kunpeng-TAP Pcore Binding Plugin
The Kunpeng-TAP Pcore Binding plugin is a physical core binding plugin provided by Kunpeng-TAP for Kata confidential containers. Kunpeng-TAP provides general-purpose topology affinity capabilities for CPUs, memory, and other container resources. On top of this, the plugin provides finer-grained physical core binding for Kata Pods. It connects to containerd through the Node Resource Interface (NRI) and consolidates the two logical CPUs of each Pod that meets the trustlist conditions onto a single physical core.
The Kunpeng-TAP Pcore Binding plugin is deployed and used in a Kubernetes cluster as a DaemonSet. It binds the two logical CPUs of a Pod to the same physical core, preventing security issues that arise when SMT causes a Pod's logical CPUs to be placed on different physical cores. The following figure shows how the plugin works based on the containerd NRI function.
