IMP

Appearance

Day 0: Install and Baseline ​

Goals ​

  • Deploy IMP components safely.
  • Validate control-plane and data-plane readiness.
  • Establish baseline observability and guardrails.

Prerequisites ​

  • Kubernetes cluster with /dev/kvm on target nodes
  • kubectl, helm, cluster-admin context (pin via --context — see Day 1)
  • Nodes labeled imp/enabled=true (source of truth: machine config patch for Talos/Omni)

Privileged Namespace ​

Imp's agent is privileged (mounts /dev/kvm, Firecracker binaries, guest kernel paths). Isolate it:

bash
kubectl create namespace imp-system --dry-run=client -o yaml | kubectl apply -f -
kubectl label namespace imp-system pod-security.kubernetes.io/enforce=privileged --overwrite

Keep imp-system as the only namespace with privileged. All other namespaces stay restricted unless independently justified. Do not relax Pod Security Admission cluster-wide.

Node Selector imp/enabled=true ​

The chart defaults both agent.nodeSelector and kvm.preflight.nodeSelector to imp/enabled=true. This label is the explicit opt-in for the scheduler and the privileged agent.

bash
# Label the pool (manage via Talos/Omni machine config patch in production)
kubectl label node <node-name> imp/enabled=true --overwrite
kubectl get nodes -l imp/enabled=true

# Verify chart values still require it
helm get values imp -n imp-system | grep -A2 nodeSelector

When adding placement constraints, keep imp/enabled=true as a required selector — do not replace it.

Install (OCI) ​

bash
helm upgrade --install imp oci://ghcr.io/syscode-labs/charts/imp --version 0.9.0 -n imp-system --create-namespace
kubectl -n imp-system get pods

Pull alternative:

bash
helm pull oci://ghcr.io/syscode-labs/charts/imp --version 0.9.0
helm upgrade --install imp ./imp-0.9.0.tgz -n imp-system --create-namespace

Image Digest Pin ​

Pin images by digest in production values and verify before promotion:

yaml
# values-production.yaml
operator:
  image:
    digest: sha256:<operator-digest>
agent:
  image:
    digest: sha256:<agent-digest>
bash
helm upgrade --install imp oci://ghcr.io/syscode-labs/charts/imp --version 0.9.0 \
  -n imp-system -f values-production.yaml

Also pin Firecracker, Jailer, guest-kernel, and rootfs artifact provenance.

Runtime OnDelete ​

imp-runtime DaemonSet uses updateStrategy: OnDelete — it never rolls or drains automatically.

To roll the runtime:

bash
kubectl cordon <node>
kubectl drain <node> --ignore-daemonsets --delete-emptydir-data
kubectl -n imp-system delete pod -l app.kubernetes.io/name=imp-runtime --field-selector spec.nodeName=<node>
kubectl uncordon <node>

Or delete the pod directly if cordon/drain is handled externally. The DaemonSet controller recreates the pod with the new spec. Do not expect a rolling update.

pressureLifecycle Opt-In ​

pressureLifecycle.enabled is false by default (opt-in). When enabled, the operator suspends resident ImpVMs — largest memory first — on nodes reporting MemoryPressure until it clears. It never auto-resumes; operator action is required.

yaml
pressureLifecycle:
  enabled: true

Enable only if your runbook covers manual resume and you monitor kubelet pressure conditions.

Checklist ​

  1. Install CRDs and controller manifests.
  2. Deploy agent DaemonSet to target nodes (verify imp/enabled=true coverage).
  3. Apply privileged imp-system namespace policy.
  4. Confirm controller and agent pods are healthy.
  5. Apply a minimal ImpVM sample and verify lifecycle.
  6. Document digest pins and OnDelete rollout procedure.

Validation Steps ​

  • kubectl get crd | grep imp
  • kubectl get nodes -l imp/enabled=true
  • kubectl -n imp-system get pods
  • kubectl -n imp-system get ds imp-runtime -o yaml | grep -A2 updateStrategy
  • kubectl get events -A --sort-by=.lastTimestamp | tail -n 50
  • kubectl get impvm -A -o wide

Baseline Controls ​

  • Pin image versions (digest) for repeatable rollouts.
  • Define resource quotas and namespace boundaries.
  • Configure log retention and metric scraping.
  • Document rollback path before production rollout.