Support for Windows privileged containers

[ambguo]

Enhancement Description

• One-line enhancement description (can be used as a release note): Windows privileged container support and host networking support.

• Kubernetes Enhancement Proposal: 1981-windows-privileged-containers

• Primary contact (assignee): @marosset

• Responsible SIGs: sig-windows, sig-node

• Enhancement target (which target equals to which milestone):

  • Alpha release (1.22)
  • Beta release (1.23)
  • Stable release (target 1.26)

• Alpha

  • KEP (k/enhancements) update PR(s):
    • Adding windows privileged containers KEP #2037 Initial KEP PR
    • KEP 1981: Windows privileged container KEP updates for alpha #2288 KEP updates to reach implementable state
    • Updating Windows HostProcess container KEP for v1.22 alpha release #2659 Updating milestones for v1.22 alpha release
  • Code (k/k) update PR(s):
    • Windows host process work kubernetes#99576
    • Explicitly skip host file mounting for Windows when HostProcess pod kubernetes#103434
  • Docs (k/website) update PR(s):
    • Windows HostProcess Container Documentation website#28413

• Beta

  • KEP (k/enhancements) update PR(s):
    • KEP-1981 Windows HostProcess containers KEP updates for beta #2865
    • KEP-1981: WindowsHostProcessContainers beta major changes #3311
  • Code (k/k) update PR(s):
    • Add Windows HostProcess Support containerd/containerd#5131
    • Stop passing WindowsHostProcessContainer annotations for CRI calls in kubelet kubernetes#105465
    • Adding kubelet metrics for started and failed to start HostProcess containers kubernetes#105406
    • Move WindowsHostProcessContainers feature-gate to Beta kubernetes#106058
    • HostProcess e2e tests to validate command / workingDir parameters kubernetes#105201
    • Adding unit test coverage for API validation for ephemeral containers in hostprocess pods on Windows kubernetes#105748
    • Adding e2e tests to validate volume mounts in HostProcessContainers on Windows kubernetes#105996
  • Docs (k/website) update PR(s):
    • Windows HostProcess Beta 1.23 Documentation website#30391

• Stable

  • KEP (k/enhancements) update PR(s):
    • KEP 1981 Windows HostProcessContainers to stable #3540
  • Code (k/k) update PR(s):
    • Add e2e to validate stats for Windows hostprocess containers kubernetes#111332
    • Adding e2e test for running Windows hostprocess containers as members of a local usergroup kubernetes#113119
    • Add e2e test to validate that hostProcess containers can use inclusterclient kubernetes#113149
    • Promoting WindowsHostProcessContainers to stable kubernetes#113476
  • Docs (k/website) update(s):
    • Updates for WindowsHostProcessContainers going to stable website#37340
    • Blog: Windows HostProcess containers going to stable website#37370

[ambguo]

/sig windows

[ambguo]

/sig node

[ambguo]

/kind feature

[ambguo]

/stage alpha
/milestone v1.20

[k8s-ci-robot]

@ambguo: You must be a member of the kubernetes/milestone-maintainers GitHub team to set the milestone. If you believe you should be able to issue the /milestone command, please contact your and have them propose you as an additional delegate for this responsibility.

In response to this:

/stage alpha
/milestone v1.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[immuzz]

/stage alpha
/milestone v1.20

[k8s-ci-robot]

@immuzz: You must be a member of the kubernetes/milestone-maintainers GitHub team to set the milestone. If you believe you should be able to issue the /milestone command, please contact your and have them propose you as an additional delegate for this responsibility.

In response to this:

/stage alpha
/milestone v1.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[immuzz]

cc: @marosset @michmike @ddebroy @jsturtevant

[kikisdeliveryservice]

Hi all,

Enhancements Lead here. Will just update the milestone for you 😄

Best,
Kirsten

[kikisdeliveryservice]

Just as a note when you convert your KEP don't forget to also include the kep.yaml

Both templates that you will need can be found here:
https://github.com/kubernetes/enhancements/tree/master/keps/NNNN-kep-template

Please also update the description when you make the PR and please link any other PRs so that this enhancement can be tracked to the milestone.

Hope that helps.

Best,
Kirsten

[kinarashah]

Hi @ambguo,

Enhancement shadow for 1.20 release here 👋.

Just wanted to check if you had a chance to convert KEP according to the template posted above (https://github.com/kubernetes/enhancements/tree/master/keps/NNNN-kep-template).

Please note that the Enhancement freeze deadline for KEPs to be included in 1.20 milestone is Tuesday, October 6.

Your proposal looks great 😄, could you please include the following when you make the KEP PR:

• Add test plans
• Update graduation criteria (you've already mentioned those, but if you could update/confirm it for 1.20, that'd be great!)
• Update state to implementable

Thank you!

[kinarashah]

Thank you @ambguo for actively working on the KEP PR!

Here's the status update based on the freeze requirements:

Requirement	Status	Comments
Test Plan	❗	missing test plans for alpha
Graduation Criteria	❗	confirm milestone to 1.20 for alpha here. Beta's set to 1.20+.
Implementable State	❗	add KEP yaml with state implementable as mentioned here. If you're looking for an example, hopefully this recently merged sig node kep yaml gives you an idea.
Merged	❗

Just a friendly reminder that we'd need all of them with ✅ status to be included in 1.20 milestone by Enhancement Freeze deadline Tuesday, October 6.

Ping me anytime on slack (kinarashah) or here if you have any questions 😄.

Thank you!!

[kinarashah]

/milestone v1.21

[k8s-ci-robot]

@kinarashah: You must be a member of the kubernetes/milestone-maintainers GitHub team to set the milestone. If you believe you should be able to issue the /milestone command, please contact your and have them propose you as an additional delegate for this responsibility.

In response to this:

/milestone v1.21

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[kinarashah]

Spoke with @marosset and @ambguo, this will be tracked alpha for 1.21 milestone and KEP PR would be merged in provisional status for now.

[michmike]

@marosset i thought we are doing privileged containers as alpha for v1.20, not 1.21

[ambguo]

@michmike from our discussion on Tuesday, we are looking into ways to address the pod networking issues mentioned. We are still investigating ways to address the challenges, so will not be able to pursue the alpha release in 1.20 since APIs may require changes depending on the solution.

[mboersma]

/label lead-opted-in

(@marosset asked me to try this.)

[k8s-ci-robot]

@mboersma: Can not set label lead-opted-in: Must be member in one of these teams: [sig-api-machinery-leads sig-apps-leads sig-architecture-leads sig-auth-leads sig-autoscaling-leads sig-cli-leads sig-cloud-provider-leads sig-cluster-lifecycle-leads sig-contributor-experience-leads sig-docs-leads sig-instrumentation-leads sig-k8s-infra-leads sig-multicluster-leads sig-network-leads sig-node-leads sig-release-leads sig-scalability-leads sig-scheduling-leads sig-security-leads sig-storage-leads sig-testing-leads sig-windows-leads]

In response to this:

/label lead-opted-in

(@marosset asked me to try this.)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[marosset]

/label lead-opted-in

[rhockenbury]

Hello @marosset 👋, 1.26 Enhancements team here.

Just checking in as we approach enhancements freeze on 18:00 PDT on Thursday 6th October 2022.

Looks like this enhancement is targeting for stage stable for 1.26 (correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP file using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: 1.26
• KEP has a updated detailed test plan section filled out
• KEP has up to date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements

For this KEP, we would just need to update the following:

• Update PR KEP-1981: WindowsHostProcessContainers beta major changes #3311 to include setting stage to stable and latest-milestone to v1.26 in the KEP file
• Merge PR KEP-1981: WindowsHostProcessContainers beta major changes #3311 which will take care of meeting the rest of the requirements

The status of this enhancement is marked as at risk. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

[rhockenbury]

This is now marked as tracked and is all set for enhancements freeze. Thanks.

[sftim]

I recommend cracking on with early work on a docs update so that these are GA quality (or have PRs open to make them be) by the appropriate review deadline.

[marosset]

I recommend cracking on with early work on a docs update so that these are GA quality (or have PRs open to make them be) by the appropriate review deadline.

I started a draft docs PR (linked in initial issue description) and will add more updates as soon as I finish up the e2e coverage that is listed as graduation criteria for this enhancement.

[sftim]

Thanks for that early start!

[marosset]

blog placeholder PR - kubernetes/website#37370

[rhockenbury]

Hi @marosset 👋,

Checking in as we approach 1.26 code freeze at 17:00 PDT on Tuesday 8th November 2022.

Please ensure the following items are completed:

• All PRs to the Kubernetes repo that are related to your enhancement are linked in the above issue description (for tracking purposes).
• All PRs are fully merged by the code freeze deadline.

For this enhancement, it looks like the following PRs are open and need to be merged before code freeze:

• Adding e2e test for running Windows hostprocess containers as members of a local usergroup kubernetes#113119

As always, we are here to help should questions come up. Thanks!

[krol3]

Hello @marosset 👋, 1.26 Release Docs Lead here. This enhancement is marked as ‘Needs Docs’ for 1.26 release.

Please follow the steps detailed in the documentation to open a PR against dev-1.26 branch in the k/website repo. This PR can be just a placeholder at this time, and must be created by November 9. Also, take a look at Documenting for a release to familiarize yourself with the docs requirement for the release.

Any doubt, reach us! Thank you!

[marosset]

Hello @marosset 👋, 1.26 Release Docs Lead here. This enhancement is marked as ‘Needs Docs’ for 1.26 release.

Please follow the steps detailed in the documentation to open a PR against dev-1.26 branch in the k/website repo. This PR can be just a placeholder at this time, and must be created by November 9. Also, take a look at Documenting for a release to familiarize yourself with the docs requirement for the release.

Any doubt, reach us! Thank you!

@krol3 I have a placeholder docs PR open and linked in the issue description :)

[krol3]

Hi @marosset ! how are you? I see a PR placeholder for the blog, I think we need an update in the documentation too.
For example update to stable, beta here:
https://kubernetes.io/docs/reference/command-line-tools-reference/feature-gates/#feature-gates-for-alpha-or-beta-features
cc @reylejano

[marosset]

Hi @marosset ! how are you? I see a PR placeholder for the blog, I think we need an update in the documentation too. For example update to stable, beta here: https://kubernetes.io/docs/reference/command-line-tools-reference/feature-gates/#feature-gates-for-alpha-or-beta-features cc @reylejano

I've got 2 place-holder PRs open against k/website for this feature
kubernetes/website#37340 - is for documentation updates
kubernetes/website#37370 - is for a blog

Let me know if there is anything else needed at this time. I'm going to work on both of these after 1.26 code-freeze.

[rhockenbury]

With kubernetes/kubernetes#113476 merged, I have this marked as tracked for code freeze.

[krol3]

Hello @marosset 👋 please take a look at Documenting for a release - PR Ready for Review to get your PR ready for review before deadline Tuesday 15th November 2022. Thank you!

[marosset]

/close

This KEP is now fully implemented.

[k8s-ci-robot]

@marosset: Closing this issue.

In response to this:

/close

This KEP is now fully implemented.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.