Kubernetes에서 WebAssembly 워크로드 실행: SpinKube·containerd Wasm Shim·runwasi 완전 가이드

// Rust로 작성한 간단한 Wasm 모듈 예시
// Cargo.toml에 [lib] crate-type = ["cdylib"] 설정 필요

#[no_mangle]
pub extern "C" fn add(a: i32, b: i32) -> i32 {
    a + b
}

#[no_mangle]
pub extern "C" fn fibonacci(n: i32) -> i64 {
    if n <= 1 {
        return n as i64;
    }
    let mut a: i64 = 0;
    let mut b: i64 = 1;
    for _ in 2..=n {
        let temp = b;
        b = a + b;
        a = temp;
    }
    b
}

# Wasm 타겟으로 빌드
rustup target add wasm32-wasi
cargo build --target wasm32-wasi --release

# 빌드 결과물 크기 확인 (일반적으로 수 KB~수 MB)
ls -lh target/wasm32-wasi/release/*.wasm

# Wasmtime으로 직접 실행
wasmtime target/wasm32-wasi/release/my_module.wasm

# WASI에서 파일시스템 접근 권한 부여 예시
# --dir 플래그로 특정 디렉토리만 접근 허용
wasmtime --dir=/tmp/data::./data my_app.wasm

# 네트워크 접근이 필요한 경우
wasmtime --tcplisten=0.0.0.0:8080 my_server.wasm

// WIT 인터페이스 정의 예시
package example:http-handler@1.0.0;

interface types {
    record http-request {
        method: string,
        uri: string,
        headers: list<tuple<string, string>>,
        body: option<list<u8>>,
    }

    record http-response {
        status: u16,
        headers: list<tuple<string, string>>,
        body: option<list<u8>>,
    }
}

world http-handler {
    import wasi:logging/logging;
    export handle-request: func(req: types.http-request) -> types.http-response;
}

kubelet → CRI → containerd → OCI Runtime (runc) → Linux Container

kubelet → CRI → containerd → containerd-shim-spin-v2 → Wasmtime/Spin → Wasm Module
                           → containerd-shim-slight-v2 → Wasmtime/SpiderLightning → Wasm Module
                           → containerd-shim-wasmedge-v1 → WasmEdge → Wasm Module

// runwasi의 핵심 트레잇 구조 (단순화)
pub trait Engine {
    fn name() -> &'static str;
    fn run_wasi(&self, ctx: &WasiCtx, module: &[u8]) -> Result<i32>;
}

// Wasmtime 엔진 구현
pub struct WasmtimeEngine;
impl Engine for WasmtimeEngine {
    fn name() -> &'static str { "wasmtime" }
    fn run_wasi(&self, ctx: &WasiCtx, module: &[u8]) -> Result<i32> {
        // Wasmtime을 사용하여 Wasm 모듈 실행
        let engine = wasmtime::Engine::default();
        let module = wasmtime::Module::new(&engine, module)?;
        // ...
    }
}

# RuntimeClass 정의
apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata:
  name: wasmtime-spin-v2
handler: spin
scheduling:
  nodeSelector:
    kubernetes.io/arch: wasm32-wasi
---
# Wasm 워크로드 Pod
apiVersion: v1
kind: Pod
metadata:
  name: wasm-hello
spec:
  runtimeClassName: wasmtime-spin-v2
  containers:
    - name: hello-wasm
      image: ghcr.io/example/hello-wasm:v1
      command: ['/hello.wasm']
  nodeSelector:
    kubernetes.io/arch: wasm32-wasi

┌─────────────────────────────────────────────────────┐
│                    Kubernetes Cluster                 │
│                                                       │
│  ┌──────────────┐       ┌────────────────────────┐  │
│  │ Spin Operator│       │    API Server           │  │
│  │              │◄──────│                         │  │
│  │ - SpinApp    │       │ SpinApp CRD registered  │  │
│  │   Controller │       └────────────────────────┘  │
│  │ - Executor   │                                    │
│  │   Selection  │                                    │
│  └──────┬───────┘                                    │
│         │ Creates/Manages                            │
│         ▼                                            │
│  ┌──────────────┐       ┌────────────────────────┐  │
│  │  Deployment  │       │   Node (Wasm-capable)   │  │
│  │  or          │──────►│                         │  │
│  │  SpinAppExec │       │  containerd             │  │
│  └──────────────┘       │    └─ shim-spin-v2      │  │
│                         │        └─ Spin Runtime  │  │
│                         │            └─ .wasm     │  │
│                         └────────────────────────┘  │
└─────────────────────────────────────────────────────┘

apiVersion: core.spinoperator.dev/v1alpha1
kind: SpinApp
metadata:
  name: hello-spin
  namespace: default
spec:
  image: ghcr.io/example/hello-spin:v1
  replicas: 3
  executor: containerd-shim-spin
  enableAutoscaling: true
  resources:
    limits:
      cpu: 100m
      memory: 128Mi
  variables:
    - name: DATABASE_URL
      valueFrom:
        secretKeyRef:
          name: db-credentials
          key: url
  runtime-config:
    key_value_stores:
      default:
        type: redis
        url: redis://redis-cluster:6379
    sqlite_databases:
      default:
        type: libsql
        url: https://my-turso-db.turso.io

# k3d 클러스터 생성 (Wasm shim이 포함된 이미지 사용)
k3d cluster create wasm-cluster \
  --image ghcr.io/spinkube/containerd-shim-spin/k3d:v0.17.0 \
  --port "8081:80@loadbalancer" \
  --agents 2

# 클러스터 상태 확인
kubectl get nodes
kubectl get runtimeclass

# Node Feature Discovery로 Wasm 지원 노드 레이블링
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: wasm-shim-installer
  namespace: kube-system
spec:
  selector:
    matchLabels:
      app: wasm-shim-installer
  template:
    metadata:
      labels:
        app: wasm-shim-installer
    spec:
      hostPID: true
      containers:
        - name: installer
          image: ghcr.io/spinkube/containerd-shim-spin/node-installer:v0.17.0
          securityContext:
            privileged: true
          volumeMounts:
            - name: containerd-config
              mountPath: /etc/containerd
            - name: shim-binary
              mountPath: /opt/kwasm/bin
      volumes:
        - name: containerd-config
          hostPath:
            path: /etc/containerd
        - name: shim-binary
          hostPath:
            path: /opt/kwasm/bin

# cert-manager 설치 (Spin Operator의 webhook에 필요)
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.16.0/cert-manager.yaml

# SpinKube CRDs 설치
kubectl apply -f https://github.com/spinkube/spin-operator/releases/download/v0.4.0/spin-operator.crds.yaml

# RuntimeClass 설정
kubectl apply -f https://github.com/spinkube/spin-operator/releases/download/v0.4.0/spin-operator.runtime-class.yaml

# Spin Operator를 Helm으로 설치
helm install spin-operator \
  --namespace spin-operator \
  --create-namespace \
  --version 0.4.0 \
  oci://ghcr.io/spinkube/charts/spin-operator

# SpinAppExecutor 생성
kubectl apply -f - <<EOF
apiVersion: core.spinoperator.dev/v1alpha1
kind: SpinAppExecutor
metadata:
  name: containerd-shim-spin
spec:
  createDeployment: true
  deploymentConfig:
    runtimeClassName: wasmtime-spin-v2
EOF

# Spin CLI로 새 프로젝트 생성
spin new -t http-rust hello-k8s --accept-defaults
cd hello-k8s

// src/lib.rs - Spin HTTP 핸들러
use spin_sdk::http::{IntoResponse, Request, Response};
use spin_sdk::http_component;

#[http_component]
fn handle_request(req: Request) -> anyhow::Result<impl IntoResponse> {
    let path = req.path();
    let method = req.method().to_string();

    println!("Received {method} request for {path}");

    let body = serde_json::json!({
        "message": "Hello from WebAssembly on Kubernetes!",
        "path": path,
        "method": method,
        "runtime": "SpinKube",
        "timestamp": chrono::Utc::now().to_rfc3339()
    });

    Ok(Response::builder()
        .status(200)
        .header("content-type", "application/json")
        .body(body.to_string())
        .build())
}

# 빌드 및 OCI 레지스트리에 푸시
spin build
spin registry push ghcr.io/myorg/hello-k8s:v1

# SpinApp으로 배포
kubectl apply -f - <<EOF
apiVersion: core.spinoperator.dev/v1alpha1
kind: SpinApp
metadata:
  name: hello-k8s
spec:
  image: ghcr.io/myorg/hello-k8s:v1
  replicas: 3
  executor: containerd-shim-spin
EOF

# 배포 상태 확인
kubectl get spinapp hello-k8s
kubectl get pods -l core.spinoperator.dev/app-name=hello-k8s

# 100개 동시 인스턴스 기준 메모리 사용량 비교 (wrk 벤치마크)
# Docker Container: ~6.4GB (64MB per instance avg)
# Spin Wasm:        ~320MB (3.2MB per instance avg)
# 메모리 효율: Wasm이 약 20배 적은 메모리 사용

# 벤치마크 명령
wrk -t12 -c400 -d30s http://localhost:8080/api/json

# Docker Container (Go HTTP Server)
# Requests/sec: 45,230
# Avg Latency: 8.8ms
# Transfer/sec: 12.3MB

# Spin Wasm (Rust HTTP Handler)
# Requests/sec: 38,750
# Avg Latency: 10.3ms
# Transfer/sec: 10.5MB

# Wasm Pod는 현재 HostPort, NodePort 바인딩에 제한이 있다
# Service mesh (Istio, Linkerd) 사이드카 패턴이 동작하지 않는다
# → Spin의 내장 HTTP 트리거를 통해 우회 가능

# 현재 권장 구성
apiVersion: v1
kind: Service
metadata:
  name: wasm-service
spec:
  type: ClusterIP # NodePort/LoadBalancer도 가능하나 제한 확인 필요
  selector:
    core.spinoperator.dev/app-name: hello-k8s
  ports:
    - port: 80
      targetPort: 80

# Wasm 워크로드 디버깅 기본 명령어
kubectl logs -l core.spinoperator.dev/app-name=hello-k8s -f
kubectl describe spinapp hello-k8s
kubectl get events --field-selector involvedObject.name=hello-k8s

# Node Pool 분리 전략
# Pool 1: 일반 컨테이너 워크로드
# Pool 2: Wasm Shim 설치된 Wasm 전용 노드

# Wasm 노드에 taint 추가
kubectl taint nodes wasm-node-1 workload-type=wasm:NoSchedule

# SpinApp에 toleration 추가
apiVersion: core.spinoperator.dev/v1alpha1
kind: SpinApp
metadata:
  name: edge-handler
spec:
  image: ghcr.io/myorg/edge-handler:v1
  replicas: 5
  executor: containerd-shim-spin
  deploymentAnnotations:
    app.kubernetes.io/part-of: edge-system
  podSpec:
    tolerations:
      - key: workload-type
        operator: Equal
        value: wasm
        effect: NoSchedule
    nodeSelector:
      kubernetes.io/arch: wasm32-wasi