OpenJDK 17 installation and Java program to a K8S worker node

[renwilloocl]

Would you please provide the procedure as to how I may install OpenJDK 17 and a Java program to a K8S worker node on Talos O/S in a private Rancher cloud? Appreciate your advice.

[smira]

I don't think I fully understand the question, but there should be no reason to install OpenJDK pn the host. Kubernetes workloads run in containers, and container image should contain everything the application needs to run, i.e. the OpenJDK should be packages with the application itself as a container image.

[renwilloocl]

Sorry that I am novice on this.

1. If OpenJDK can be installed on the host, it need not be present on every container. Would that save space for all the worker nodes if my K8S cluster just runs Java applications?
2. If I have an image built with a Java application on OpenJDK with Alpine Linux (e.g., https://hub.docker.com/r/bellsoft/liberica-openjdk-alpine), will it run on Talos? Must the image with the Java application be built with the OpenJDK installed on Talos Linux? If so, how may the image based on Talos Linux be built for the worker node?

[sergelogvinov]

Hi, kubernetes launches only container images. You do not need to install any application on the host machine (worker nodes).
So, You can use the openjdk based images (like you ask bellsoft/liberica-openjdk-alpine)

[renwilloocl]

1. What is the relationship between the Talos Linux OS and the Java application container image built based on a Linux distro other than Talos? If there is no relationship, do I have to cater for security vulnerabilities of the other Linux distro in the container image? If I have to cater for other Linux distro's vulnerability, how would Talos help?
2. If the container image must be based on Talos Linux OS, then how can I get the Talos Linux OS for building the Java application container image?
   Sorry that there are some basic container OS concepts that I am unclear.

[smira]

You're asking about running workloads on Talos. As Talos installs and manages Kubernetes, your workloads will run on Kubernetes, so any general advice/blog on running Java applications in Kubernetes will apply perfectly for Talos.

Talos provides great security to the host operating system, when compared with other operating systems (e.g. running Kubernetes on Ubuntu Linux), but using Talos doesn't mean you don't have to care about the container image security. You still need to make sure you're applying best security practices to the workloads.

[renwilloocl]

Appreciate again your kind explanation. My question is how to associate my Java application's container image with the POD. Per my limited knowledge, in K8S, it can be done via Deployment and the yaml file will specify the container image to use (https://kubernetes.io/docs/concepts/workloads/controllers/deployment/). How may I do the same in Talos? What Talos cli command (https://www.talos.dev/v0.14/reference/cli/) and configuration files should I be using?

_[BTW, what I was worrying is about the compatibility between the container OS of the Java application container image that I use and the host OS in Talos. There is an old article saying that "portability is not the same as compatibility" (http://crunchtools.com/portability-not-compatibility/).

• So as long as I ensure that the container OS of the container image is based on a Linux kernel version the same as the Linux kernel version that Talos uses, I should not be worried as what you clarify for me.
• I can find that the Linux version of the Talos release here: https://github.com/siderolabs/talos/releases. For example, the latest Talos release version is using Linux: 5.15.28. As long as as my Java application's container image is built based on a Linux distro with kernel version 5.15.x , there should be absolutely no compatibility issues. If the kernel version differs, normally there should still be no issue as long as the architecture matches and the libraries are compatible with the host kernel too.

Thanks for your prior explanations. I think that I have a better understanding now.]_

[smira]

Once Talos is up and running, it boots Kubernetes, so there's nothing special about using Kubernetes on Talos vs. using Kubernete in general. `talosctl -n <NODE> kubeconfig` downloads the `kubeconfig` (client-side Kubernetes configuration), and after that regular `kubectl` commands might be used to access Kubernetes resources. Message ID: ***@***.***

…

com>

[renwilloocl]

Oh I see now. I misunderstood that I have to use talosctl instead of kubectl to access Kubernetes resources. Thanks a lot for the clarification again.