-
Notifications
You must be signed in to change notification settings - Fork 558
Hyper-v containers not working on kubernetes v1.10 #2627
Comments
@brusMX Seems feature gates |
@feiskyer that is a tricky question. By definition in the json file is enabled.
What does this mean? Here is the command I ran to verify this: azureuser1@k8s-master-86740673-0:~$ ps aux | grep feature-gates
root 9543 2.2 1.7 682956 126280 ? Ssl Apr06 90:54 /usr/local/bin/kubelet
--enable-server
--node-labels=kubernetes.io/role=master,kubernetes.azure.com/cluster=hybridk8srg012
--v=2 --volume-plugin-dir=/etc/kubernetes/volumeplugins --address=0.0.0.0
--allow-privileged=true --anonymous-auth=false --authorization-mode=Webhook
--azure-container-registry-config=/etc/kubernetes/azure.json --cadvisor-port=0
--cgroups-per-qos=true --client-ca-file=/etc/kubernetes/certs/ca.crt
--cloud-config=/etc/kubernetes/azure.json --cloud-provider=azure
--cluster-dns=10.0.0.10 --cluster-domain=cluster.local --enforce-node-allocatable=pods
--event-qps=0
--eviction-hard=memory.available<100Mi,nodefs.available<10%,nodefs.inodesFree<5%
**--feature-gates=** --image-gc-high-threshold=85 --image-gc-low-threshold=80
--keep-terminated-pod-volumes=false --kubeconfig=/var/lib/kubelet/kubeconfig
--max-pods=30 --network-plugin=cni --node-status-update-frequency=10s
--non-masquerade-cidr=10.240.0.0/12
--pod-infra-container-image=k8s-gcrio.azureedge.net/pause-amd64:3.1
--pod-manifest-path=/etc/kubernetes/manifests
--register-node=true
--register-with-taints=node-role.kubernetes.io/master=true:NoSchedule
root 9970 4.7 8.6 968448 617152 ? Ssl Apr06 189:46 /hyperkube apiserver
--admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota,DenyEscalatingExec,AlwaysPullImages
--advertise-address=10.255.255.5 --allow-privileged=true --anonymous-auth=false
--audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100
--audit-log-path=/var/log/audit.log --authorization-mode=Node,RBAC
--bind-address=0.0.0.0 --client-ca-file=/etc/kubernetes/certs/ca.crt
--etcd-cafile=/etc/kubernetes/certs/ca.crt --etcd-certfile=/etc/kubernetes/certs/etcdclient.crt
--etcd-keyfile=/etc/kubernetes/certs/etcdclient.key --etcd-quorum-read=true
--etcd-servers=https://127.0.0.1:2379
**--feature-gates=HyperVContainer=true**
--insecure-port=8080 --kubelet-client-certificate=/etc/kubernetes/certs/client.crt
--kubelet-client-key=/etc/kubernetes/certs/client.key --profiling=false
--repair-malformed-updates=false --secure-port=443
--service-account-key-file=/etc/kubernetes/certs/apiserver.key
--service-account-lookup=true
--service-cluster-ip-range=10.0.0.0/16 --storage-backend=etcd3
--tls-cert-file=/etc/kubernetes/certs/apiserver.crt
--tls-private-key-file=/etc/kubernetes/certs/apiserver.key --v=4
root 10023 2.9 2.1 416824 149500 ? Ssl Apr06 117:27 /hyperkube controller-manager --allocate-node-cidrs=false --cloud-config=/etc/kubernetes/azure.json --cloud-provider=azure --cluster-cidr=10.240.0.0/12 --cluster-name=hybrid-cluster-012 --cluster-signing-cert-file=/etc/kubernetes/certs/ca.crt --cluster-signing-key-file=/etc/kubernetes/certs/ca.key --feature-gates=ServiceNodeExclusion=true --kubeconfig=/var/lib/kubelet/kubeconfig --leader-elect=true --node-monitor-grace-period=40s --pod-eviction-timeout=5m0s --profiling=false --root-ca-file=/etc/kubernetes/certs/ca.crt --route-reconciliation-period=10s --service-account-private-key-file=/etc/kubernetes/certs/apiserver.key --terminated-pod-gc-threshold=5000 --use-service-account-credentials=true --v=2
root 10560 0.1 1.2 352544 88300 ? Ssl Apr06 5:23 /hyperkube proxy --kubeconfig=/var/lib/kubelet/kubeconfig --cluster-cidr=10.240.0.0/12 --feature-gates=ExperimentalCriticalPodAnnotation=true
azureus+ 33464 0.0 0.0 12916 936 pts/0 S+ 18:26 0:00 grep --color=auto feature-gates |
On the windows node, when I see at the kubelet process I see that it doesn't have the PS C:\k> $process = "kubelet.exe"
>> Get-WmiObject Win32_Process
-Filter "name = '$process'" | Select-Object CommandLine | out-string -Width 2000
CommandLine
-----------
"C:\k\kubelet.exe" --hostname-override=86740k8s9010
--pod-infra-container-image=kubletwin/pause --resolv-conf= --allow-privileged=true
--enable-debugging-handlers --cluster-dns=10.0.0.10
--cluster-domain=cluster.local --kubeconfig=c:\k\config
--hairpin-mode=promiscuous-bridge --v=2
--azure-container-registry-config=c:\k\azure.json --runtime-request-timeout=10m
--cloud-provider=azure --cloud-config=c:\k\azure.json
--image-pull-progress-deadline=20m --cgroups-per-qos=false -
-enforce-node-allocatable= --volume-plugin-dir=c:\k\volumeplugins
--network-plugin=cni --cni-bin-dir=c:\k\azurecni\bin
--cni-conf-dir=c:\k\azurecni\netconf |
@JiangtianLi Any pointers on this? |
Ok, so I got it working with a few hacks. [BUG] Missing "HyperV" flag on Kubelet.Kubelet is not being started with the flag "orchestratorProfile": {
"orchestratorType": "Kubernetes",
"orchestratorRelease": "1.10",
"kubernetesConfig": {
"apiServerConfig" : {
"--feature-gates": "HyperVContainer=true"
}
}
} To hack this manually you need to add this flag to kubelet in all the masters and all the nodes (at least the windows nodes). Add HyperV flag on Linux Masters:
Add HyperV flag on Windows Masters:
Confirm HyperV IsolationDeploy the following hyperv-winserver.yaml file: kubectl apply -f hyperv-winserver.yaml apiVersion: v1
kind: Service
metadata:
name: win-webserver
labels:
app: win-webserver
spec:
ports:
# the port that this service should serve on
- port: 80
targetPort: 80
selector:
app: win-webserver
type: LoadBalancer
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
labels:
app: win-webserver
name: win-webserver
spec:
replicas: 1
template:
metadata:
annotations:
experimental.windows.kubernetes.io/isolation-type: hyperv
labels:
app: win-webserver
name: win-webserver
spec:
containers:
- name: windowswebserver
image: microsoft/windowsservercore:1709
command:
- powershell.exe
- -command
- "<#code used from https://gist.github.com/wagnerandrade/5424431#> ; $$listener = New-Object System.Net.HttpListener ; $$listener.Prefixes.Add('http://*:80/') ; $$listener.Start() ; $$callerCounts = @{} ; Write-Host('Listening at http://*:80/') ; while ($$listener.IsListening) { ;$$context = $$listener.GetContext() ;$$requestUrl = $$context.Request.Url ;$$clientIP = $$context.Request.RemoteEndPoint.Address ;$$response = $$context.Response ;Write-Host '' ;Write-Host('> {0}' -f $$requestUrl) ; ;$$count = 1 ;$$k=$$callerCounts.Get_Item($$clientIP) ;if ($$k -ne $$null) { $$count += $$k } ;$$callerCounts.Set_Item($$clientIP, $$count) ;$$header='<html><body><H1>Windows Container Web Server</H1>' ;$$callerCountsString='' ;$$callerCounts.Keys | % { $$callerCountsString+='<p>IP {0} callerCount {1} ' -f $$_,$$callerCounts.Item($$_) } ;$$footer='</body></html>' ;$$content='{0}{1}{2}' -f $$header,$$callerCountsString,$$footer ;Write-Output $$content ;$$buffer = [System.Text.Encoding]::UTF8.GetBytes($$content) ;$$response.ContentLength64 = $$buffer.Length ;$$response.OutputStream.Write($$buffer, 0, $$buffer.Length) ;$$response.Close() ;$$responseStatus = $$response.StatusCode ;Write-Host('< {0}' -f $$responseStatus) } ; "
nodeSelector:
beta.kubernetes.io/os: windows RDP into the Windows node that is running your pod. Do a |
Another way to set it is kubeletConfig |
@feiskyer thanks for the input! {
"apiVersion": "vlabs",
"properties": {
"orchestratorProfile": {
"orchestratorType": "Kubernetes",
"orchestratorRelease": "1.10",
"kubernetesConfig": {
"apiServerConfig" : {
"--feature-gates": "HyperVContainer=true"
},
"kubeletConfig" : {
"--feature-gates": "HyperVContainer=true"
}
}
},
"masterProfile": {
"count": 1,
"dnsPrefix": "hyperv-cluster-012",
"vmSize": "Standard_DS2_v2"
},
"agentPoolProfiles": [
{
"name": "linuxpool1",
"count": 1,
"vmSize": "Standard_DS2_v2",
"storageProfile" : "ManagedDisks",
"availabilityProfile": "AvailabilitySet"
},
{
"name": "windowspool1",
"count": 1,
"vmSize": "Standard_D2_v3",
"availabilityProfile": "AvailabilitySet",
"osType": "Windows"
}
],
"windowsProfile": {
"adminUsername": "azureuser1",
"adminPassword": "pss10rdw!"
},
"linuxProfile": {
"adminUsername": "azureuser1",
"ssh": {
"publicKeys": [
{
"keyData": ""
}
]
}
},
"servicePrincipalProfile": {
"clientId": "",
"secret": ""
}
}
} And I got excited because I ssh into the master and kubelet was running with the needed hyperv flag. Nevertheless, when I RDP into the windows node kubelet doesn't have the hyperV flag: PS C:\Users\azureuser1> $process = "kubelet.exe"
>> Get-WmiObject Win32_Process -Filter "name = '$process'" | Select-Object CommandLine | out-string -Width 2000
CommandLine
-----------
"C:\k\kubelet.exe"
--hostname-override=14796k8s9010
--pod-infra-container-image=kubletwin/pause --resolv-conf= --allow-privileged=true
--enable-debugging-handlers --cluster-dns=10.0.0.10 --cluster-domain=cluster.local
--kubeconfig=c:\k\config --hairpin-mode=promiscuous-bridge --v=2
--azure-container-registry-config=c:\k\azure.json --runtime-request-timeout=10m
--cloud-provider=azure --cloud-config=c:\k\azure.json --image-pull-progress-deadline=20m
--cgroups-per-qos=false --enforce-node-allocatable= --volume-plugin-dir=c:\k\volumeplugins
--network-plugin=cni --cni-bin-dir=c:\k\azurecni\bin --cni-conf-dir=c:\k\azurecni\netconf At least now, the only thing to do is to fix the way windows is starting kubelet to accept kubeletConfig. |
So this is a Windows Kubelet config problem. @JiangtianLi Could you help to fix this issue? |
btw - here's my gist with steps to deploy. https://gist.github.com/PatrickLang/2cf4b81c9518e531b828a71e4c430332 Looking forward to |
Thanks for the input @PatrickLang, good idea just replacing the output script before deployment. I am waiting for @jiantianli to roll a fix :) |
@brusMX Assigned and will work on it. Thanks for reporting. |
/assign |
@PatrickLang: GitHub didn't allow me to assign the following users: PatrickLang. Note that only Azure members and repo collaborators can be assigned. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
/assign patricklang |
I was trying to do this on 1803, and I got:
Do you know if Hyper-V is disabled on 1803 by default? I can't get it to work even after I give the powershell command:
and reboot (hyperv is already installed). <> Ignore the above, was the wrong size! Standard_E8_v3 did the trick |
What vm sku did you use? It's only on some sku like dv3 and ev3. Maybe f but I'm not 100% |
Interestingly, DS3_v2 didn't work, but Ex_v3 does it. Time to write a blog post about this findings.. |
@ams0 - You will need one of the nested virtualisation VMs (Dv3 or Ev3) as per the comment by @PatrickLang. A DS3_v2 is not a nested virtualisation capable VM. Have a look at #3246 - Windows kubelet defaults are mistakenly applied to Linux agents - I think there are still issues running this setup currently. Nested Virtualisation VMs: |
I should have this fixed by end of week now that #3246 is out of the way. I have a branch where I'm refactoring and cleaning up the kubelet parameters - https://github.com/patricklang/acs-engine/tree/patricklang-2627 |
Windows Server version 1709 pods seem to work ok on 1803, but 2016 is broken. 2 bugs: |
Is this a request for help?:
Yes
Is this an ISSUE or FEATURE REQUEST? (choose one): Feature request
What version of acs-engine?:
Version: canary
GitCommit: b143b6d
GitTreeState: clean
Orchestrator and version (e.g. Kubernetes, DC/OS, Swarm)
Kubernetes
What happened:
Deployed a hybrid kubernetes cluster (Win/Linux) Hyper-v enabled, but it won't deploy hyper-v isolated containers.
This is my
hyperv-cluster.json
file:And I am deploying a yaml file like this,
hyperv-win-sever.yaml
:What you expected to happen:
When I RDP into the windows container and RDP into the machine I don't get a hyper-v Isolated container,
docker inspect hyperv-winserver
. All I get is"Isolation": "process"
Nevertheless, when I run:
I totally get a hyperv isolated container.
How to reproduce it (as minimally and precisely as possible):
As described above, deploy a cluster and deploy the yaml deployment, rdp into the vm and docker inspect the container.
Anything else we need to know:
I know it's super experimental, but we are running an investigation on Windows Containers and I would definitely appreciate your feedback on how to get this working. Thanks!
The text was updated successfully, but these errors were encountered: