Example guide for kata containers (#138)

* adding kata conatainers instruction

* adjust get kata-qemu and remove install sandbox bad link

* link to kata install guide

* add section for apply the kata overlay

Author: volatilemolotov

examples/vscode-sandbox/README.md

@@ -48,6 +48,51 @@ kubectl apply -k overlays/gvisor
 
 Validate that the `Pod` with gVisor enabled is running:
 
+```shell
+$ kubectl wait --for=condition=Ready sandbox sandbox-example
+$ kubectl get pods -o jsonpath=$'{range .items[*]}{.metadata.name}: {.spec.runtimeClassName}\n{end}'
+```
+### Harden Agent Sandbox isolation using Kata Containers (Optional)
+
+#### Prerequisites
+
+* Host machine that supports nested virtualization
+
+   You can verify that by running:
+
+   ```sh
+   cat /sys/module/kvm_intel/parameters/nested
+   ```
+   In case of AMD platform replace `kvm_intel` with `kvm_amd`
+   The output must be “Y” or 1.
+
+* [minikube](https://minikube.sigs.k8s.io/docs/start/?arch=%2Flinux%2Fx86-64%2Fstable%2Fbinary+download)
+* [kubectl](https://kubernetes.io/docs/tasks/tools/)
+
+#### Create minikube cluster
+
+> Note:
+> At this moment, we use only `containerd` runtime, since it works without additional adjustments.
+
+```sh
+minikube start --vm-driver kvm2 --memory 8192  --container-runtime=containerd --bootstrapper=kubeadm
+```
+
+#### Install Kata Containers
+
+Follow the instructions provided at [Kata Containers Installation Guide](https://github.com/kata-containers/kata-containers/tree/main/docs/install)
+
+#### Create a Sandbox using the kata-qemu runtimeClassName
+
+Apply the kustomize overlay to inject `runtimeClassName: kata-qemu` to the
+`vscode-sandbox` example and apply it to the cluster:
+
+```shell
+kubectl apply -k overlays/kata
+```
+
+Validate that the `Pod` with Kata container enabled is running:
+
 ```shell
 $ kubectl wait --for=condition=Ready sandbox sandbox-example
 $ kubectl get pods -o jsonpath=$'{range .items[*]}{.metadata.name}: {.spec.runtimeClassName}\n{end}'

examples/vscode-sandbox/overlays/kata/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- ../../base
+
+# This example adds the "kata" runtimeClassName to the Sandbox Pod spec
+patches:
+- path: patch-kata.yaml
+  target:
+    kind: Sandbox
+    name: sandbox-example

examples/vscode-sandbox/overlays/kata/patch-kata.yaml

@@ -0,0 +1,9 @@
+apiVersion: agents.x-k8s.io/v1alpha1
+kind: Sandbox
+metadata:
+  name: sandbox-example
+spec:
+  podTemplate:
+    spec:
+      # Set runtimeClassName to use kata qemu class
+      runtimeClassName: kata-qemu