Add Host process examples

[jsturtevant]

Reason for PR:

Start providing some examples of how to use hostprocess

Issue Fixed:

Issue #

Requirements

• Sqaush commits
• Documentation
• Tests

Notes:

This is meant to be an example to start testing things out. Not ready for production.

[marosset]

Can we use NT AUTHORITY\\NetworkService here?

[jsturtevant]

It is on my list to try this. local system did not work because calls to HNS apis failed silently

[perithompson]

The network service doesn't work either, I think there were some folder permissions or something, I can't quite remember but I was hoping to use network service as well!

[jsturtevant]

I'll give this a try and see if I get an error message. @dcantah @kevpar any thoughts on what specific permissions are needed?

[dcantah]

No not off the top of my head, I can ask some hns folks

[liggitt]

what interprets this envvar? normally, envvars would be specified in args as $(CONTAINER_SANDBOX_MOUNT_POINT)/calico/install.ps1 (https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/#using-environment-variables-inside-of-your-config)

[liggitt]

same question about what component evaluates/expands this envvar... are envvars normally usable inside workingDir?

it looks like the kubelet only expands envvars in command/args, and workingdir is passed as-is to the runtime:

https://github.com/kubernetes/kubernetes/blob/95390e6476fca15b0f55cde2c142ec18ca57aee0/pkg/kubelet/kuberuntime/kuberuntime_container.go#L313-L329

[marosset]

These variables are set for processes created inside the container by hcsshim (for both normal and hostProcess containers). Windows will expand and environment variables found in the command line when it tries to runt he process / entry point for the container.

[jsturtevant]

The runtime sets and evaluates these ENV variables as part of its path processing. We can't use the approach in https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/#using-environment-variables-inside-of-your-config) since it is not known until runtime since that value is set by hcsschim.

Using the vars, technically shouldn't be necessary for hostprocess but we found some bugs in hcsshim around arg and Working directory path processing. With the approach that we are evaluating now this env variable won't be necessary any longer as the container will be given its own filesystem (thought it still has access to the host filesystem unlike on linux).

For reference these are the fixes that are in being worked on until the new approach is validated:
microsoft/hcsshim#1137
microsoft/hcsshim#1117

cc: @dcantah

[marosset]

Can we update the 1.22.1 references to 1.22.2?

[marosset]

Can we update the 1.22.1 references to 1.22.2?

Other than that I think this is ready to merge (and we can iterate later if needed)

[marosset]

/lgtm

I think this is ready to merge. We can iterate if needed.
Thanks for all this work @jsturtevant

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jsturtevant, marosset

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [jsturtevant,marosset]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[vitaliy-leschenko]

Please make sigwindowstools/flannel-tools:v0.14.0-hostprocess as public. Currently we don't have access to the image.

[jsturtevant]

@vitaliy-leschenko It should be
sigwindowstools/flannel:v0.14.0-hostprocess. Will update that typo. Please note these samples and let us know how it works!