►
From YouTube: What's New With SIG-Windows: HostProcess and Developer... B. Smith, D. Canter, J. Vyas, F. Wilken
Description
Don’t miss out! Join us at our next event: KubeCon + CloudNativeCon Europe 2022 in Valencia, Spain from May 17-20. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
What's New With SIG-Windows: HostProcess and Developer environments - Brandon Smith & Danny Canter, Microsoft; Jay Vyas, VMware; Friedrich Wilken, SAP
Members of the SIG-Windows community will provide an update on the efforts to bringing Windows workloads to Kubernetes. We'll start off by going over recent improvements including a demo of the new HostProcess feature enabling “privileged” containers on Windows. Next we'll talk about planned future improvements. We'll then show our new development tooling that will enable you to get started with development for Windows in Kubernetes. Lastly we'll finish up with some Questions and Answers with the speakers.
A
Hello,
everybody
and
welcome
to
cubecon
north
america
2021.
This
is
the
maintainer
series
talk
for
sig
windows
and
let's
get
started
first,
I'm
going
to
introduce
all
of
the
speakers.
I'll
start
with
myself.
My
name
is
mark
rossetti.
I
am
a
software
engineer
at
microsoft.
I
am
currently
the
co-chair
for
sig
windows.
I
work
in
azure
and
there
are
is
my
github
and
slack
handles
next?
Is
danny
cantor.
B
C
Hey
I'm
jay
jay
unit
100
and
I
hang
out
with
mark
and
james
and
friedrich
too
sick
windows
lead
and
the
tech
lead
for
kubernetes
on
windows
at
vmware
and
yeah
someday.
I
think
the
coop
proxy
for
windows
will
be
cleaned
up
and
moved
somewhere,
fancy
we're
not
sure
yet.
Hopefully,
the
kaping
project
and
juno
100
on
twitter.
D
E
A
All
right,
thank
you.
Everybody!
Here's
a
brief
overview
of
the
agenda.
We're
going
to
be
talking
about.
What's
new
in
sig
windows,
I'm
going
to
give
some
updates
about
windows,
server,
2022
and
then
talk
about
the
new
windows
developer
environment
that
we've
been
working
on
to
make
it
easier
to
spin
up
windows
clusters
and
then
talk
about
host
process
containers.
A
So
here's
a
kind
of
brief
overview
of
everything.
That's
happened
since
the
last
kubecon
talk.
The
first
is
csi
plugin
support
for
windows
is
now
generally
available,
there's
a
link
to
the
enhancement
for
anybody
who's
interested.
This
means
that
all
csi
plugins
now
are
compatible
with
windows.
Nodes
next
is
host
process
containers
or,
as
most
people
refer
to
them,
the
equivalent
of
privileged
containers
on
linux,
hit
alpha
in
122..
This
is
a
huge
milestone
for
windows.
We
can
and
enables
us
to
support
many
other
scenarios.
A
Next
is
the
for
123
we're
pursuing
a
number
of
different
caps.
The
first
one
is
a
way
to
identify
windows
pods
at
api
admission
time.
This
will
make
it
so
that
policies
can
choose
to
enforce
specific
settings
on
pod
specs
for
windows
versus
linux,
pods
and,
most
importantly,
adds
a
new
os
field
to
the
pod
spec.
A
lot
of
people
have
been
asking
for
this.
A
We're
excited
for
this
to
finally
happen,
and
the
last
one
I
wanted
to
call
out
was
there's
an
enhancement
that
we
are
also
pursuing
for
alpha,
where
that
will
make
it
so
that
you
can
view
the
cube
or
the
the
node
logs
with
cube
ctl
logs.
This
is
going
to
address
some
feedback.
We've
had
that
it's
kind
of
hard
to
debug
issues
with
windows
systems,
services
on
kubernetes.
A
D
D
D
Alongside
this
we're
improving
application,
compatibility
and
compatibility
between
host
and
container
images
with
process
isolation.
So,
basically,
what
we're
allowing
here
is
the
ability
to
run
a
server,
2022
container
image
on
all
versions
of
windows,
11
and
windows,
server
2022
through
the
next
long
term,
servicing
channel
release.
So
basically,
if
you
build
a
server
2022
container
image
now,
it
should
be
able
to
run
on
your
windows,
11
host
or
your
windows,
server
server,
2022
deployment
up
through
windows,
server
2025.
D
This
allows
us
to
basically
change
the
the
the
the
apis
between
user
and
kernel
mode
across
ltscs,
but
still
ensure
that
you
could
run
your
ltsc
2022
image
for
a
long
period
of
time
longer
than
was
previously
previously,
but
previously
available.
And
alongside
this
we
are
deprecating
stack
releases.
This
is
supplemented
by
the
host
and
container
image
compatibility
that
I
just
mentioned.
D
So
your
windows,
server,
2022
container
image,
will
be
able
to
run
anywhere
going
forward
and
won't
depend
on
a
updated
host,
so
I'm
gonna
hand
it
off
now.
Oh,
yes,
we
have
some
more
information
available
here
on
windows.
Server,
22
feel
free
to
take
a
look
at
any
of
these
blog
posts
to
gain
more
information
or
contact
us.
If
you
have
any
specific
questions
so,
let's
hand
it
off
to
the
windows
developer,
environment
now.
C
Yeah,
so
we
on
the
community
side,
we
have
a
bunch
of
cool
stuff
that
will
sort
of,
I
think,
sort
of
kick-start
people,
especially
in
the
kubernetes
community,
people
that
are
developing
people.
That
know
golang,
that
understand
kubernetes
that
want
to
get
involved
and
help
out
making
windows
server,
a
really
kubernetes
native
sort
of
sort
of
sort
of
sort
of
enabled
enabled
extension
to
kubernetes
right
and
so
at
the
node
level.
So
we
now
have
a
repository.
C
It's
sig,
slash,
sig
windows,
sig
dash
windows,
dash
dev
dash
tools,
and
we
don't
have
the
url
here.
But
that's
fine
I'll,
show
you
what
it
does.
You
can
go
in
there
and
you
can
clone
it
down
and
it
has
a
few
couple
of
yaml
files
and
you
can
modify
those
and
you
can
run
vagrant
up
and
then
you
can
you
can
you
can
pick
your
cni
and
it
will
compile
the
kubelet
from
scratch.
C
E
So,
let's
take
a
look:
how
we
do
again.
We
have
a
yama
file
that
allows
us
to
set
certain
things.
For
example,
you
can
set
the
kubernetes
shell,
so
you
can
copy
paste
from
github
your
char
for
the
latest
version
of
kubernetes
set
the
override
windows
bins
onto
now.
You,
you
have
cloned
the
repository
on
your
system,
so
on
your
host
system,
you
find
a
mac
file
and
that
allows
you
if
you
want
to
to
compile
all
the
binaries,
the
cubelet
and
the
proxy
for
the
windows
machine.
E
The
makefile
then
starts
a
wagon
file.
This
spins
up
a
windows,
virtual
machine
linux,
virtual
machine.
It
starts
the
kubernetes
cluster.
It
takes
the
token
on
the
flyer,
writes
a
cube,
join
ps1
script.
That
starts
the
node
on
windows
that
automatically
joins
the
cluster
and
after
that
we
set
up
via
cube
ctl
your
cni
plugin.
In
this
example,
we
use
calico.
So
you
get
your
calico
part.
You
get
your
calico
services
on
the
windows,
note
and
yeah,
and
so
in
the
end
you
you
get
a
cluster
built
from
source.
E
C
D
All
right
so
in
alpha
in
122
is
kubernetes.
We
released
a
feature
called
post
process
containers.
This
feature
has
been
a
long
time
coming
and
it
enables
a
lot
of
new
scenarios
for
windows,
container
users,
so
basically
host
process
containers
aim
to
extend
the
windows
container
model
and
enable
a
wider
range
of
kubernetes
cluster
management
scenarios.
So
what
we
have
here
is
basically
a
container
that's
capable
of
running
on
the
windows
host
directly
with
with
direct
access
to
anything
that's
available
in
windows
host.
D
With
a
host
process
container,
the
container
image
is
literally
running
just
as
a
process
on
the
host,
so
it
has
its
own
volume
mounted
file
space,
that's
part
of
the
host,
but
the
post
process
container,
depending
on
the
user
permissions
that
you're
running
it,
as
has
access
to
all
the
resources
on
the
host.
So
you
can
do
things
like
install
drivers
and
a
whole
bunch
of
other
management
scenarios
that
apply
to
the
host
directly.
D
So
host
process
containers
are
like,
I
said,
before:
a
method
for
packaging
and
the
packaging
and
distribution
of
management
operations
which
require
access
to
the
host.
They
should
not
be
used
as
methods
for
you
know,
deploying
server
workloads
or
you
know
your
containerized
workload
that
you
want
to
run,
applications
with
or
anything
that
requires
security,
because
these
do
have
access
to
the
windows
and
posts
that
are
running
windows
nodes.
D
So
anything
that
you
can
do
with
the
process,
you
can
do
with
windows
host
process
container,
so
you're
able,
like
I
said
before,
you're
able
to
install
a
file
system
and
sorry
access
the
host
file
system
and
install
drivers
and
system
services,
and
you
can
reduce
the
privilege
of
your
other
windows
notes.
These
are
not
process
of
file
system
isolated,
like
like
a
process
isolated
container,
so
these
do
not
have
their
own
name
space.
D
These
will
be
supported
on
computer
d.
Only
as
we've
made
a
lot
of
the
changes
specific
to
host
process
containers
in
container
d
and,
like
I
said
before,
there's
they're,
not
a
replacement
for
windows,
server,
containers,
they're,
a
method
for
management
and
configuration
of
windows,
nodes
to
run
windows,
server
containers.
B
D
B
All
right
so,
as
brandon
just
stated,
the
demo
is
going
to
show
off
installing
and
getting
calico
running
on
a
windows
node
with
the
cluster
api
for
azure
and
via
host
process
containers.
So
for
some
background
on
this
currently
to
install
calico
on
windows
notes,
you
need
to
install
it
as
a
windows.
Service
generally
be
the
script
that
they
provide,
which
is
kind
of
a
pain.
B
So
one
of
the
top
things
at
least
interest-wise,
that
we'd
seen
for
host
process
containers
was
trying
to
solve
this
exact
problem
so
moving
away
from
this
model
needing
to
deploy
so
many
things
on
windows
as
windows
services
and
try
and
move
everything
to
the
same
kind
of
containerized
deployment
model
that
everyone's
already
accustomed
to.
So
instead
of
running
these
things
as
services,
we
could
just
package
them
in
a
container
image
and
then
run
them
via
a
host
process
container.
B
B
So
if
we
scroll
up
a
bit-
and
we
found
our
culprit-
kublet-
not
ready-
and
it's
because
the
cni
plugin
is
not
initialized,
so
pretty
much.
The
rest
of
the
demo
is
trying
to
solve
this,
so
getting
it
to
run
on
the
top
tab.
We're
gonna
ssh
into
the
not
ready
windows
node
to
try
and
figure
out
why
the
c9
plugin
is
not
initialized.
So
I'm
going
to
check
out
some
state
we're
going
to
check
the
location
where
the
container
runtime
is
trying
to
look
for
the
cni
configuration
files
and
empty.
B
B
So
we're
going
to
open
up
an
editor
window
with
the
spec
that
we're
going
to
apply
on
the
node
to
try
and
solve
this
with
the
host
process
container
go
all
the
way
to
the
top.
We
have
a
config
map
and
data
section
cni
network
config
is
the
ci
configuration
that
we're
going
to
write
out
in
place
on
this
machine.
B
What's
in
it
isn't
too
important
for
this:
let's
go
all
the
way
down
and
I'm
going
to
pause
here
again,
and
this
is
the
new
host
process
option
on
the
security
context,
specifically
the
windows
option,
if
you're
familiar
with
privileged
containers
on
linux,
it's
kind
of
the
same
thing
except
obviously
it's
it's
a
bool
on
the
linux
options
and
named
privilege,
but
it's
pretty
much
the
same.
You
know
use
case
here.
You
set
this
to
true
and
you're
asking
for
a
host
process
pod,
you
can
see,
you
run
his
username.
B
So
this
will
run
before
everything
else
scroll
down
a
bit
and
we
have
two
containers,
one
that
the
name
of
this
might
give
away.
This
is
going
to
set
up
the
node
to
run
calico,
that's
going
to
run
the
node
service,
powershell
script,
that
they
provide
and
then
scroll
down
a
bit
more
and
we
have
the
second
container.
That's
going
to
run
the
calico
felix
binary
with
the
felix
service.
Powershell
script
also.
B
B
C
So
as
that
boots
danny
really
quickly
the
real
reason,
this
is
real
exciting
is
you
know
in
docker
we
didn't
we
had
in
the
container
days.
You
don't
have
that
bridge
right,
so
you
can't
rely
on
the
bridge
for
these
host
process
networks
anymore,
and
so
it's
very,
very
critical.
So
it's
really
exciting.
B
B
We
can
check
out
the
logs
for
the
calico
pod
and
we
should
be
able
to
see
all
the
way
at
the
bottom
that
we
have
some
entries
for
setting
up
the
hms
endpoint
for
the
is
bond,
so
everything
seemed
to
work
out,
which
is
awesome,
and
that
is
the
demo
pretty
much.
I
hope
this
was
cool
to
see
and
kind
of
gives
you
an
idea
of
the
types
of
things
that
these
can
be
used
for
to
kind
of
simplify
administrative
tasks
at
least
and
yeah.
A
And
awesome,
thank
you
for
the
demo
danny.
I
think
this
everybody
is
excited
about
all
the
different
possibilities
that
this
can
bring
for
anybody,
who's
interested
here's,
some
more
information
about
how
you
can
configure
your
cluster
to
run,
host
process,
containers
and
more
information
about
what
the
future
holds.
C
We
got
a
lot
of
people
that
have
been
ramping
up,
new
people
and
some
old
friends
as
well.
Perry
and
perry,
of
course
worked
hard
with
danny
and
the
rest
of
the
container
team
on
helping
out
the
host
process
stuff.
These
are
all,
of
course,
people
that
aren't
here
on
this
talk,
I
ameem
is
a
new
contributor.
He
got
calico
and
stuff
working
on
our
internal
developer
environments
and
also
put
a
patch
up
to
calico
node,
to
make
it
easier
to
run
it
on
different
interfaces.
C
C
C
And
yeah,
we
we
that's,
that's
not
that's
not
all,
though
we've
got
a
lot
of
work
to
do
so
come
join
us.
I
think
we're
one
of
the
most
fun
cigs
that
I've
ever
worked
in.
We
move
quickly
on
things
and
we
work
together.
We
pair
on
things.
We
have
these
pairing
sessions
after
every
single
one
of
our
sig
windows
meetings
and
we
just
get
in
there
and
like
build
stuff
together.
Anybody
can
join.
C
You
don't
have
to
understand
windows
to
do
it
most
of
it's
just
go,
laying
and
just
it's
just
like
anything
else,
and
we
have
community
meetings.
Of
course,
every
12
30
est
on
tuesdays
and
we're
there's
a
lot
of
opportunities
for
leadership
there
as
well
on
various
sub
initiatives
of
the
sig.
You
know,
for
example,
the
stuff
danny
presented.
I
mean
there's
so
much
interesting
stuff.
You
can
explore
around
privileged
containers,
getting
those
working,
etc.
C
Of
course,
there's
always
documentation
stuff,
like
that
user
stories,
testing,
stuff,
trying
stuff
out,
reporting
bugs
and
we've
got
a
project
board.
So
if
you
want
to
go,
look
at
the
project
board
and
just
grab
a
ticket
and
work
on
your
own,
that's
fine
too!
You
don't
have
to
hang
out
with
us.
There's
all
sorts
of
ways
to
contribute.
C
And
that's
pretty
much
it
so
we've
got
mark
is
the
marks
our
chair
and
me
james
and
claudio
our
tech
leads
and
we
can
reach
any
of
us
at
any
time.
We're
always
happy
to
get
in
there
and
work
on
work
on
stuff
with
you.
Look
at
stuff
join
us
in
sig
windows
on
slack,
that's
our
rallying
point
for
for
the
community
and
all
the
other,
well-known
mailing
lists
and
like
github,
repos
and
everything
else,
so
yeah
come
get
involved.
A
All
right,
thank
you,
everybody
who
is
speaking
today.
The
community
really
appreciates
your
all
of
these
updates
and
all
the
information
and
thank
you,
everybody
for
attending
the
sig
windows
maintainer
series
session.
We
understand
that
this
is
a
hybrid
event
and
unfortunately
nobody
from
sick
windows
will
be
able
to
present
live,
but
we
hope
to
be
able
to
do
so
in
the
future
and
now
q,
a.