Blog: Windows HostProcess containers going to stable #37370

marosset · 2022-10-18T21:47:09Z

Signed-off-by: Mark Rossetti [email protected]

Signed-off-by: Mark Rossetti <[email protected]>

marosset · 2022-10-18T21:47:31Z

/sig windows
/milestone v1.26
/cc @brasmith-ms

k8s-ci-robot · 2022-10-18T21:47:33Z

@marosset: GitHub didn't allow me to request PR reviews from the following users: brasmith-ms.

Note that only kubernetes members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to this:

/sig windows
/milestone v1.26
/cc @brasmith-ms

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-ci-robot · 2022-10-18T21:47:33Z

@marosset: You must be a member of the kubernetes/website-milestone-maintainers GitHub team to set the milestone. If you believe you should be able to issue the /milestone command, please contact your Website milestone maintainers and have them propose you as an additional delegate for this responsibility.

In response to this:

/sig windows
/milestone v1.26
/cc @brasmith-ms

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

netlify · 2022-11-14T20:44:31Z

✅ Pull request preview available for checking

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`4b89a79`
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/638fd83d47ed7a000a40b8cc
😎 Deploy Preview	https://deploy-preview-37370--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site settings.

bradmccoydev · 2022-11-16T09:57:42Z

Hello @marosset! v1.26 Comms shadow here. This feature blog is on a feature tracked for release, the deadline for submitting a draft is the 29th of November; this should be considered the hard limit since we will need to review/edit/discuss the draft, so if at all possible it's better to submit it earlier to avoid any problems.

Any doubts, we're here to help! cc @fsmunoz

fsmunoz · 2022-11-24T23:26:29Z

Hello @marosset, we're doing a global reminder about submitting a draft for review for all opted-in feature blogs. If it's at all possible, it is very helpful for the release team to have drafts submitted for review before the hard deadline date, to better plan the release dates and avoid missing out. Thank you!

jayunit100 · 2022-11-29T11:43:24Z

/lgtm
/approve

jayunit100 · 2022-11-29T11:43:53Z

/assign @onlydole

jayunit100 · 2022-11-29T15:36:15Z

oh wait, we need to remove the todos
/hold

sftim

A couple more things. We could ship this; there is room for polish.

/lgtm
/approve
/hold

OK to unhold once Kubernetes v1.26 is released. Re-LGTMs are available too!

content/en/blog/_posts/2022-12-12-host-process-containers-stable/index.md

sftim · 2022-12-06T20:52:57Z

content/en/blog/_posts/2022-12-12-host-process-containers-stable/index.md

+The Kubernetes project strongly recommends against mounting a host volume into a Windows Server
+container in order to minimize potential attack surfaces. HostProcess containers enable you to configure
+the host, along with privileged helper Pods, so that communication with your Windows workloads
+in containers happens within the bounds of a secure pipeline.


I agree, it's be nice to reword.

k8s-ci-robot · 2022-12-06T20:54:17Z

LGTM label has been added.

Git tree hash: 626f974de5cf391780155dc3871ccd9102c76c8b

fsmunoz · 2022-12-07T15:27:36Z

Marking this Ready for Publishing in Comms tracking, thank you for all the work - minor edits/reviews are still doable until the release date.

/lgtm

k8s-ci-robot · 2022-12-07T15:27:44Z

LGTM label has been added.

Git tree hash: 9dad978fe22fd27bbc388e2d630ec32e83bace88

jsturtevant

minor nit
/lgtm

jsturtevant · 2022-12-07T19:48:57Z

content/en/blog/_posts/2022-12-13-host-process-containers-ga/index.md

+
+What are HostProcess containers and why are they useful?
+
+Cluster operators are often faced with the need to configure their nodes upon provisioning. Whether it's


Suggested change

Cluster operators are often faced with the need to configure their nodes upon provisioning. Whether it's

Cluster operators are often faced with the need to configure their nodes upon provisioning such as

k8s-ci-robot · 2022-12-08T19:25:52Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dtzar, jayunit100, profnandaa, sftim

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~content/en/blog/OWNERS~~ [sftim]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

aravindhp

Great blog post, @marosset @brasmith-ms. I left a few comments.

aravindhp · 2022-12-08T18:02:05Z

content/en/blog/_posts/2022-12-13-host-process-containers-ga/index.md

+making network configuration changes, or even deploying monitoring tools such as a Prometheus's node-exporter.
+Previously, performing these actions on Windows nodes was usually done by running PowerShell scripts
+over SSH or WinRM sessions and/or working with your cloud provider's virtual machine management tooling.
+HostProcess containers now enable you to do all of this and more with minimal effort.


I suggest adding ...with minimal effort using Kubernetes native APIs.

aravindhp · 2022-12-08T18:27:34Z

content/en/blog/_posts/2022-12-13-host-process-containers-ga/index.md

+
+[HostProcess containers](/docs/tasks/configure-pod-container/create-hostprocess-pod/) differ
+quite significantly from regular Windows Server containers.
+They are run directly as processes on the host under the access policies of


Suggested change

They are run directly as processes on the host under the access policies of

They are run directly as processes on the host with the access policies of

aravindhp · 2022-12-08T18:46:43Z

content/en/blog/_posts/2022-12-13-host-process-containers-ga/index.md

+quite significantly from regular Windows Server containers.
+They are run directly as processes on the host under the access policies of
+a user you specify. HostProcess containers run as either the built-in Windows system accounts or
+ephemeral users within a user group defined by you. HostProcess containers also share


How are these ephemeral users created? Are they in the host or in the container? Maybe just call that out.

aravindhp · 2022-12-08T19:54:24Z

content/en/blog/_posts/2022-12-13-host-process-containers-ga/index.md

+If you have a compatible node (for example: Windows as the operating system
+containerd v1.7 or later), you can deploy a Pod with one


Suggested change

If you have a compatible node (for example: Windows as the operating system

containerd v1.7 or later), you can deploy a Pod with one

f you have a compatible node (for example: Windows as the operating system

with containerd v1.7 or later as the container runtime), you can deploy a Pod with one

@aravindhp I think there is a typo in your suggestion

Sorry about that @sftim

Suggested change

If you have a compatible node (for example: Windows as the operating system

containerd v1.7 or later), you can deploy a Pod with one

If you have a compatible node (for example: Windows as the operating system

with containerd v1.7 or later as the container runtime), you can deploy a Pod with one

marosset · 2022-12-09T00:43:59Z

I'm going to do another round of updates to incorporate all the feedback tomorrow.

fsmunoz · 2022-12-10T19:35:23Z

Hi @marosset ,thanks for your work on this. It would be good to be able to merge this as soon as possible, especially considering that this is one of the very first blogs to go out and we don't have much time until the publication date.

sftim · 2022-12-11T12:38:28Z

/hold cancel

We have a brief opportunity to do updates before publication; otherwise, it's still OK to make corrections for up to 1 year afterwards. Beyond that time, we de-prioritise review effort and only really consider it if the article is obviously misleading.

allyford · 2023-01-11T18:43:49Z

content/en/blog/_posts/2022-12-13-host-process-containers-ga/index.md

+
+Cluster operators are often faced with the need to configure their nodes upon provisioning. Whether it's
+installing Windows services, configuring registry keys, managing TLS certificates,
+making network configuration changes, or even deploying monitoring tools such as a Prometheus's node-exporter.


Prometheus's windows_exporter
Also may want to add a link: https://github.com/prometheus-community/windows_exporter/blob/master/kubernetes/kubernetes.md
node exporter is for linux

good catch. Could you open PR for these fixes? They would got live as soon as we merge it, if I understand correctly

allyford · 2023-01-11T18:47:31Z

content/en/blog/_posts/2022-12-13-host-process-containers-ga/index.md

+Here are just a few of the many use use cases with example deployments:
+
+- [CNI solutions and kube-proxy](https://github.com/kubernetes-sigs/sig-windows-tools/tree/master/hostprocess/calico#calico-example)
+- [windows-exporter](https://github.com/prometheus-community/windows_exporter/blob/master/kubernetes/windows-exporter-daemonset.yaml)


windows_exporter

Blog: Windows HostProcess containers going to stable

edae203

Signed-off-by: Mark Rossetti <[email protected]>

k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Oct 18, 2022

k8s-ci-robot added the sig/windows Categorizes an issue or PR as relevant to SIG Windows. label Oct 18, 2022

marosset mentioned this pull request Oct 18, 2022

Support for Windows privileged containers kubernetes/enhancements#1981

Closed

35 tasks

k8s-ci-robot added area/blog Issues or PRs related to the Kubernetes Blog subproject language/en Issues or PRs related to English language labels Oct 18, 2022

k8s-ci-robot requested review from nate-double-u and onlydole October 18, 2022 21:48

k8s-ci-robot added the sig/docs Categorizes an issue or PR as relevant to SIG Docs. label Oct 18, 2022

Added initial HPC GA blog content

00a5e13

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Nov 14, 2022

k8s-ci-robot assigned jayunit100 Nov 29, 2022

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 29, 2022

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 29, 2022

marosset marked this pull request as ready for review November 30, 2022 01:01

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 30, 2022

k8s-ci-robot requested a review from sftim November 30, 2022 01:01

Updated the TODOs with additional content

9bec873

brasmith-ms added 3 commits December 6, 2022 11:43

Adding the hpc .svg diagram

beee64d

Updating the blog to use the .svg

bc12f00

Delete hpc_architecture.png

ef8963d

sftim reviewed Dec 6, 2022

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Dec 6, 2022

fixing date

9ca8fe4

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Dec 6, 2022

k8s-ci-robot requested a review from sftim December 6, 2022 21:55

marosset added 3 commits December 6, 2022 15:54

More updates based on PR feedback

47f649c

renaming use cases to hostprocess containers in action

95fd2b4

minor fixups

4b89a79

k8s-ci-robot assigned fsmunoz Dec 7, 2022

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Dec 7, 2022

jsturtevant reviewed Dec 7, 2022

View reviewed changes

k8s-ci-robot assigned jsturtevant Dec 7, 2022

profnandaa approved these changes Dec 8, 2022

View reviewed changes

aravindhp reviewed Dec 8, 2022

View reviewed changes

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Dec 11, 2022

k8s-ci-robot merged commit 2e9393b into kubernetes:main Dec 11, 2022

marosset deleted the hpc-stable-blog branch December 12, 2022 19:18

marosset mentioned this pull request Dec 12, 2022

Minor updates to 2022-12-13-host-process-containers-ga blog #38437

Merged

allyford reviewed Jan 11, 2023

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Blog: Windows HostProcess containers going to stable #37370

Blog: Windows HostProcess containers going to stable #37370

marosset commented Oct 18, 2022

marosset commented Oct 18, 2022

k8s-ci-robot commented Oct 18, 2022

k8s-ci-robot commented Oct 18, 2022

netlify bot commented Nov 14, 2022 •

edited

Loading

bradmccoydev commented Nov 16, 2022

fsmunoz commented Nov 24, 2022

jayunit100 commented Nov 29, 2022

jayunit100 commented Nov 29, 2022

jayunit100 commented Nov 29, 2022

sftim left a comment

sftim Dec 6, 2022

k8s-ci-robot commented Dec 6, 2022

fsmunoz commented Dec 7, 2022

k8s-ci-robot commented Dec 7, 2022

jsturtevant left a comment

jsturtevant Dec 7, 2022

k8s-ci-robot commented Dec 8, 2022

aravindhp left a comment

aravindhp Dec 8, 2022

aravindhp Dec 8, 2022

aravindhp Dec 8, 2022

aravindhp Dec 8, 2022

sftim Dec 8, 2022

aravindhp Dec 9, 2022

marosset commented Dec 9, 2022

fsmunoz commented Dec 10, 2022

sftim commented Dec 11, 2022

allyford Jan 11, 2023

jsturtevant Jan 12, 2023

allyford Jan 11, 2023


		What are HostProcess containers and why are they useful?

		Cluster operators are often faced with the need to configure their nodes upon provisioning. Whether it's

	They are run directly as processes on the host under the access policies of
	They are run directly as processes on the host with the access policies of

		If you have a compatible node (for example: Windows as the operating system
		containerd v1.7 or later), you can deploy a Pod with one

Blog: Windows HostProcess containers going to stable #37370

Blog: Windows HostProcess containers going to stable #37370

Conversation

marosset commented Oct 18, 2022

marosset commented Oct 18, 2022

k8s-ci-robot commented Oct 18, 2022

k8s-ci-robot commented Oct 18, 2022

netlify bot commented Nov 14, 2022 • edited Loading

✅ Pull request preview available for checking

bradmccoydev commented Nov 16, 2022

fsmunoz commented Nov 24, 2022

jayunit100 commented Nov 29, 2022

jayunit100 commented Nov 29, 2022

jayunit100 commented Nov 29, 2022

sftim left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

k8s-ci-robot commented Dec 6, 2022

fsmunoz commented Dec 7, 2022

k8s-ci-robot commented Dec 7, 2022

jsturtevant left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

k8s-ci-robot commented Dec 8, 2022

aravindhp left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

marosset commented Dec 9, 2022

fsmunoz commented Dec 10, 2022

sftim commented Dec 11, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

netlify bot commented Nov 14, 2022 •

edited

Loading