Cloud computing, offering on-demand access to computing resources through the Internet and the pay-as-you-go model, has marked the last decade with its three main service models; Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS). The lightweight nature of containers compared to virtual machines has led to the rapid uptake of another in recent years, called Containers as a Service (CaaS), which falls between IaaS and PaaS regarding control abstraction. However, when CaaS is offered to multiple independent users, or tenants, a multi-instance approach is used, in which each tenant receives its own separate cluster, which reimposes significant overhead due to employing virtual machines for isolation. If CaaS is to be offered not just at the cloud, but also at the edge cloud, where resources are limited, another solution is required. We introduce a native CaaS multitenancy framework, meaning that tenants share a cluster, which is more efficient than the one tenant per cluster model. Whenever there are shared resources, isolation of multitenant workloads is an issue. Such workloads can be isolated by Kata Containers today. Besides, our framework esteems the application requirements that compel complete isolation and a fully customized environment. Node-level slicing empowers tenants to programmatically reserve isolated subclusters where they can choose the container runtime that suits application needs. The framework is publicly available as liberally-licensed, free, open-source software that extends Kubernetes, the de facto standard container orchestration system. It is in production use within the EdgeNet testbed for researchers.

翻译：摘要：云计算通过互联网按需提供计算资源并采用按用付费模式，其三大主要服务模式——基础设施即服务（IaaS）、平台即服务（PaaS）和软件即服务（SaaS）——塑造了过去十年的技术格局。相较于虚拟机，容器因轻量级特性使得近年来另一种服务模式迅速普及，即容器即服务（CaaS），该模式在控制抽象层面介于IaaS与PaaS之间。然而，当CaaS面向多个独立用户（即租户）提供服务时，当前多采用多实例方案，即每个租户拥有独立集群，这种方案因需使用虚拟机实现隔离而再次引入显著开销。若CaaS不仅要部署于云端，还需部署于资源受限的边缘云，则亟需替代方案。本文提出一种原生CaaS多租户框架——租户共享集群，其效率显著优于"每租户专属集群"模型。当资源被共享时，多租户工作负载的隔离问题随之凸显。此类工作负载当前可通过Kata Containers实现隔离。此外，本框架充分尊重应用需求：对于要求完全隔离与高度定制化环境的场景，节点级切片机制使租户能以编程方式预留隔离子集群，并自主选择适配应用需求的容器运行时。本框架已以宽松许可协议开源发布，作为事实标准容器编排系统Kubernetes的扩展组件，并已在面向研究者的EdgeNet测试平台中投入生产使用。