There's currently a proof-of-concept integration under contrib/kata-containers. The patch doesn't apply cleanly anymore, and it still had some shortcuts, so it wasn't really something we could propose upstream. I think the integration would still make sense, in general terms: networking is a big reason why the CRI runtime in Kata Containers currently needs to run as root.