Kubernetes SIG Windows, 2 Jun 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Kubernetes SIG Windows 20200602

Description

Kubernetes SIG Windows 20200602

A

Hello, everybody and welcome to another sick windows meeting it's the 2nd of June or first meeting in June. As always, this is a since EF meeting. So please adhere to the same zip code of contact, and this is a recorded meeting as well all right. Taking a look at our discussion. Topics xavier is first and joining our community to discuss the fqdn feature happier. You have the floor, hello.

B

Thank you yeah, so wanted to chat with you guys to see from windows perspective. It is make sense that so I chat a little bit with mark before so this feature, just to give some context, is about setting the fqdn of a host into the host name field of the kernel for talking about linux world. So this is has been like a long disagreement in Linux community in the UNIX and Linux community, between gray hat and and before we had some unique systems and others like Debian that they disagree.

B

Whether the hostname field of the kernel had the fqdn or should have just a short name.

B

So these features will enable that for for Linux, so one question I had is whether running Linux containers on Windows couplets will work and transfer this property I believe it will because I didn't see a custom runtime for Windows to run containers, so it should be just propagating one field through and the other question is like whether Windows it makes sense for Windows to have for Windows containers to have this field set I believe from some quick test that I did with a colleague and Mark I.

B

Think confirmed that when you said, for example, in docker, you do dhakkir on Dutch age and a string Windows will just go and say three in the computer name, so hos name does exit we'll just return that a string so but market concerns with that. You may not be able to join any domain. Nothing yeah.

A

So I mean the windows. Containers cannot be actually joined to the domain, so I mean the only thing that windows can have is a host name right. Mark there's no way, I mean that as far as I know, there's no way you can have an if Acadian in a Windows container, yeah.

C

I think that yeah, that's true I, think that you can kind of get access to resources that are part of a domain by using group managed service accounts yeah, but containers itself can't be joined to domains and I had asked a couple of folks on the windows networking team to investigate this I see Jocelyn is here. He was one of the people who was looking at it, but not the main person. Looking into this to see if it makes sense in any other scenarios right.

D

Yeah I wish David was here: I think he was looking into it a little bit more so I'm, not an expert on the naming of the machines and everything. But my experience in the past was that we have functions in Windows that, basically you pass a flag and it gives either the hostname order fqdn. So basically based on that and looking into what keep definition was and the reason for doing it.

D

The question I had and I asked David and the other folks is: do we need the same fix for Windows, apps and or the doing want to just have the host name and it's fine for Windows apps, so that that's an open question today. It.

C

Looks like David is joined as well. Oh.

D

So David do you want to take it from here.

E

But sitting was named to the fqdn, yes correct, yeah I think I'm still looking to hear back from some people that have worked with no customers either on compute side or networking. So I don't have seen this trends because I don't know if this is a requirement for Windows apps the way it has been put forth as a recommendation for lips and Linux distributions, so I think I'm still looking for more feedback from customers and following up with other PM's, if this would make sense in Windows.

E

So I don't have a really good answer at this time. Yeah.

C

I think the good news is is that this is going to be a feature in the API models on the pod spec. So we can just provide guidance if we don't have a clear answer in the near future via documentation about if this should be set for Windows or not. Have you asked about Linux containers on Windows today? I, actually, don't believe that we that Cooper, that there's support in kubernetes to schedule Linux containers on Windows no.

A

I think that's gonna open up a can of worms right. You know how you said our basic Linux file, file properties, I know with the windows subsystem for Linux a lot of those things may work, but it's a lot of testing to actually validate download rows.

B

Okay in the Canaries dogs- and they talk about hyper-v that will allow you to run Linux containers. But you saying that's not really supporting.

C

I was gonna say so, with container D we're going to be working on enabling hyper-v, isolated containers and that technology can support, running Linux containers on Windows, but that whole integration with kubernetes is still very much kind of it's still very much work in progress and the initial goals for that are to be able to run Windows OS containers of that mismatch hosts on a Windows nodes and not to light up the Linux containers on windows.

C

At this point because, as Michael said, there's just gonna be a ton of testing, that's needed to even identify what works and what won't work. Yeah.

A

And and kind of think about I think you know you may have alluded to hyper-v earlier so so we hyper-v you can actually create Linux virtual machines and have a full kubernetes cluster on top of it. But then you're dealing with virtual machines and the container level. That's the answer. The mark gave you that with container D and you'll, be able to add hyper-v isolated container is a coupie Linux, but it just opens up a kind of worms. Okay,.

B

Okay, so I mean something soon they're like you're saying it will start on Linux VM and then from there on it will be just a Linux, couplet yeah. That's.

A

Right yeah, so you could run on top of hyper-v. Virtual machines are running Linux and have a full company. This cluster inside it's a Windows OS like your hypervisor, is Windows and then you're on virtual machines that basically become your worker nodes in kubernetes and those are all running Linux and you can have an environment there. That's one way of doing it. The other way is what Mark mentioned, where you have a Windows hypervisor, a Windows VM that acts as your worker node in kubernetes, and then you can run using container D hyper-v, isolated container.

A

That would be Linux. That's we don't want to support that I mean not not right. Now, that's not in scope, I! Think.

B

All right, so that sounds good so then like for, for, like Mark said this is going to be a field on the Apollo spec for commenting a field. I still need to get off this review. I just call it yesterday to pass all the integration tests and everything, but so I'm planning to like some kind of comment on the field for the auto documentation. Something saying like this says: if fqdn of Apple has a host name in his four containers in Linux, it means that you do like the host name.

B

If you know the kernel know, name like the UTS name like I have right now a comment say in Windows container. This means setting the computer name the computer to fqdn, because I think that's what happened. So my question is like what should I write for Windows, like should I, say something in Windows container. This doesn't make sense or like what? What do we put there so to give advice to people when they look at the dogs.

C

David or Jocelyn is this something that you could help just get a new.

E

C

For an answer right now, then.

E

Then my answer would be and know that I don't know of such trends. I'm following up with other people in case there does exist a trend so yeah. Unfortunately, I need a little bit more time, probably one or two weeks to get back to you. Okay,.

B

I think it's fine, so I can put for now in Windows containers.

B

This shouldn't be used.

E

Yeah windows apps don't take a dependency on the hosting being set to the fqdn.

B

Okay, yeah, that's mostly the thing about this gap is about backward compatibility for all linux applications. But if lean in Windows I guess you guys are more consistent because you have like a unified governance and like Linux so and.

D

If I can give us a little bit more details on how the hostname is resolved, usually when you pass over, whose name on Windows Windows tries to find whether it's a NetBIOS name, whether it's a DNS name- and it basically has a sequence of trying to find out, I mean try to append the DNS name to the host name and trying to find the fqdn. So in most cases for Windows apps what's happening is that you have? You can pass just the host name and most of the time will work.

B

So there is no like equivalent to host name fqdn like in minute.

D

Yeah, that's a good question: I haven't really used the data stash of QT and I would need to look into what it does to really tell you.

D

It was more speaking about the general case where how basically, how apt deal with names and if they give just the whose name, usually they are auto-completed, based on what what windows can find and how we know this configured I.

B

Say: okay, so you guys don't like set the domain on the Linux container like I've. Seen like docker has an option to set domain, but I don't think that's using Windows I mean in Linux. Sorry in Linux. Do you guys do it or.

D

B

Right, so you mostly rely just on DNS to do the right thing.

D

Yes, at least for add some windows but yeah. Your question was more around containers. I need to double-check that.

B

Okay, so I'll put like something along the lines that in Windows container this doesn't seem like a train and it probably shouldn't be used as you won't be able to join the domain.

B

Something like that and then I have I can add you guys on the PR students, so you can see, and so yes, rephrasing or something yeah.

A

So I mean I, see this in two ways, so in the PR and in the code make a mention there about how this expected to work on Windows and then in the documentation of this feature, we need to actually clear call it out when you're writing the docs for this, that this is on Windows you're, not getting an F, QT and you're getting a name. So it needs to be crystal clear, so developers or consumer of this have clear expectations on what's gonna come back.

B

Okay, so in Windows.

A

B

A name it doesn't matter has dots or whatever it's just all.

A

Dogs are not supported in a internet. Bios name in Windows will just be a name I.

B

Think, okay, all right sounds good mark.

A

Are you okay? With that I mean you know. Basically, two things put some comments in the code that says you know this behaves differently or Windows, so they call it out and then in the documentation that goes up about this this field, it just says: hey and windows, you're not gonna, have kitty, and in Linux you may get a hostname or fqdn, but in Windows you would always be hosting them. Yeah.

C

Yeah I think that makes sense, but.

B

I like to connect it like a wanted you to help me try this out because, like when we run like a quick test like with dog, around Shh and I'm kind of like an fqdn like with thoughts and all that on. A windows container is just to do hostname and it will return to this whole string.

B

So because so I'm saying this because in the couplet at runtime there is no logic saying this is going to go to create a sandbox for Windows or for Linux. It's all the same code.

A

Are you asking if someone can test your PR with you is that is that the question.

C

I think the havior of what apps or containers will do with this functionality and a volt correct.

B

Yes, like because, like my understanding will be based on the docker test, will be that these stream, that I pass, whether is like just a name or a name with dots, will show up in the computer name of a Windows machine.

B

That's my my understanding, based on the docker, run test that with it and just want to make sure that from window from cornet is it does all these? That's I think it will, because when I just call out to dock here or whatever is underneath but I, don't know what you guys think, because I.

C

Mean we can do a quick test to see if, if we enable this for Windows node, if the computer name environment, variable is set kind of as expected, but I think the question that we're trying to really answer here, though, is it was like once we like if this gets set, how do you allocate ins behave how to Windows applications behave in those containers and I think that's what we're still having I think we still need to do some more digging, as David mentioned, that there's still some people who are digging until they said looking to see if customers have kind of reported, apps behaving differently, either way.

C

B

See, okay, so I lived in the comments. Kind of like I. Have it now and so I had this big PR that you Mark are seeing it but I think I'm going to split it in two. So I can have review the API side because it's generates tons of files and then like the cooler side. So we can see more clearly what my code changes are doing. It's actually pretty small code change and then, like you, guys, can help to test that.

B

That would be great I'm going to also try to work with my colleague I work to see we can set up equivalent is cluster and Sandy aims to see if I can test it. Also myself, but but yeah so I be happy to hear the feedback from you guys, and this is I'm intending to I'm trying to get this into 118. So code freeze is June. 25 119, you mean rank yeah, 119, yes siree!

B

So so I'm going to set up the PRS Friday this afternoon, like the ones for actual reviewing once everything passed and then like I, already have appear for talks because the requires but dogs are free, so in July is something so we have some more time for for dogs to make sure that will clarify everything properly on the actual dogs so mark.

A

Thank you, Mark, really quickly. Sorry, counting so did I hear correctly that you might be able to try this out and see what it looks like this is an optional feature right, so it's kubernetes Connor and force pushing the flag to every container or does a user. The user has been indicated right, yah-hoo, the.

B

User has to set this like, so there has to happen to things like first that the user set this flag to true and second, that the user set a suit domain field as well. So these two field has to be set for these to be changing. Behavior also.

A

Mark like for the upset, this doesn't work, they just don't set it. So I was just responding to the command immediately remark: yeah.

C

Well, like I, think all of its documented for Windows it like with docker if you pass hostname, is that the whatever you pass in hostname will be set as the environment variable computer name.

F

C

Could Val we could validate that that works, but I, don't think we'd be able to do any, give any guidance about how to do apps. At this point, no.

A

No, we don't know you just have to say that is what happens that way that way, Xavier can document it so so kind of put your name here. A mark.

A

B

Sure, yeah yeah, without you don't set anything like this bhakti behavior is like it said to omit empty. So if he's false or you don't set it, this doesn't do anything mm-hmm.

C

A

Essentially, in Windows, you know where make sure that in your dog's PR for this, you indicate that you have to write sectional windows in terms of what the experience would look like. Okay and.

C

I think that we can like when I say we here folks from Microsoft, can look into the container networking and probably give a quick snippet of what to put for there. Yeah.

A

If it's just an environment variable that changes, then we can just put that there. But if you do a IP config, what's you know if you dump your thing like what what the other things are asked said there, but you're right, mark yeah.

B

So, like my dog PR is in kubernetes website is pull request, one two one: zero.

A

Go ahead and put a placeholder for Windows to make sure that did nobody forget about that. That.

B

Way when it's time to write.

A

It will help you put the right details there. So.

B

Like I just comment on the pier that we need to think on windows, I mean.

A

If you PR already started changing text from the website, go Co, add a section that says Windows and leave it empty and say TBD that way. We don't we don't forget it. Oh ok.

B

Sounds good yes, I'll! Do that, let's.

A

Move on to the next topic: Jing security policy.

G

Yes, so I just want to kind of get understanding the current status of para security policy I see there is issue there, but it was not updated recently and I was trying to test allowed host path. I think I did something wrong. That's why it's not working just want to verify. It should work on both Windows and Linux right, I.

H

Think the parsing of the windows paths might be different and that might need some extra support. Jing. Oh yes,.

G

So the the backslash thing yeah.

H

Yeah, that's probably the main thing that needs to be reviewed so.

G

Here, no one like try it out before.

H

So for PSP, the only thing I tried is like whether to allow host mounts or not. That's not like not made the prefix as well, so I think the worst one is like enforced at the master level and that just works across Windows and Linux. Like you know, what are the types of volume mounts allow and you want to enable host path or not? Okay, but the allowed host part which is like you know whose paths with certain prefix only bad part I did not test, and that probably requires him. Yeah.

A

Well, that's for sure, not gonna work with you, because it's just different address addressing.

H

A

Like, for example, privilege mode doesn't work on Windows right, so setting up those policies, definitely.

A

Support feature yeah.

G

But so I think it would be good if we have a clear documentation like exactly which parties working for Windows and or any work on going like work. Try to make some of the feature parity like or some some parts available, also for Windows. It.

A

Spot security policy owned by six security or is it owned by a sick note.

G

There is a security but I, never like a yeah I.

I

Think it one big note or as I remember and.

F

I think pod security policy may not be going to GA, and so it works. I think that's.

H

What Kim's comment was on that.

H

G

H

Nothing yeah so.

G

It's about two years ago, but I feel it's important right. This security policy mm-hmm, so if we want to restrict some use, cases like host pass, is also like one of the common things we want to say definitely.

I

It's a gatekeeper, the where we should be looking at.

F

Yeah I think that's the the general direction.

F

Trying to find the issue.

H

I'm like as far as I, understand gatekeeper internally user spot security policies for kubernetes right or is it like a completely different stack.

I

What policy agent.

I

Security policy, deep as far as I, understand I- think it was a new implementation. Okay,.

H

I

An open policy agent but yeah, it's the Jing gatekeeper, is the new aisle. We can take offline on that or we can put a link in there in the dog about gatekeeper.

G

Thank you, yeah.

A

All right, then, I'll have a few more minutes on. Does Windows Server support, eClass addresses, Dinesh or David this year. David gonna. Take that sorry, the pod security policy. Oh no David, there's the new question is: does Windows Server support eClass addresses to 4200 for.

E

Actually, I'd have to follow up internally. I, don't know what this.

A

What did this question.

J

Is me you see, you then asked disk Russians like but I she didn't cut. The answer so I'm asking it here so classy address is the reserved the address space is none RFC, 1918.

E

J

So we tried it to a proper. We I am running on Windows Server and the ways this classy I dress. But there are some networking connectivity problem. So what I'm wondering so wider, just a Windows Server, that is a party. Oh wait, hardly something wrong!.

E

So what are you trying to sit.

J

I am with Windows Server, 2000, 19 or 1918 and waste a classy address as we arms, I, dress or.

E

Was the the VM addresses okay.

J

Yeah, usually, arms I, dress, okay,.

E

J

I, try need not about October night here's. This is about just the way. I am and yeah window.

H

J

Okay, yeah I haven't got to the equipment at his party edge. Shall we just want to be honest? We are amazed, he's classy, I dress. If don't know the liable or the way I'm level can community is ok, then we guy to the coronaries not working, but right now we are still I'd. I don't know that I will way I'm alive. Oh.

E

Okay, oh yeah, I can fall by next week. That's.

J

Mate. Thank you. Yeah.

E

A

All right- and there was one question on the chat really quickly about you- know if you can run certain communities, master components like the API server on Windows. The answer is: no, all the master components need to be on Linux Windows can only be a worker node J, you need I. Think you had one more question. Is there a guest book style started up on kubernetes for Windows?

A

Please, if you haven't posted that post Adams on the slack channel for Windows, we did form a new new group called Windows samples, I'm wondering if anybody has started putting Apps in there. If they haven't, we should soon yeah.

K

I uh for context, I see you in another life, sometimes so um yeah I, you know I just have I didn't hack it around with I. Have a Windows laptop I was like well I finally got to try kubernetes on it and I'm, not a Windows for something so I'm like trying to figure out how to think about.

K

You know like its entire world of kubernetes on Windows, just just for the hell of it like I, don't have an agenda, and so, if there's a way, I can help out or something I could test so that I can learn more like in spare cycles. I'm happy to you know, try to look at.

F

Before you ping.

K

Me on something.

A

Yeah we have a few samples laying around the views for uh for demos, I'll I'll see, if you can ping me on slack m2 is my alias on the communities like I'll see if I can find a few uh and and send them your way. Yeah.

K

A

Definitely do have a guest booked up for Windows using read Eason, you know the goal, so I just have to find it what it is. Okay,.

K

In general, where is the starting point? People.

C

K

Link this sample.

C

App from Petra clang of former pretty heavy contributor for sig windows into this I think this is what we were going to one of the ones we were going to move into the Cygnus samples, apps.

K

Okay, you all when you run this stuff, you do you. Do you spin up an API server in the Linux world and then you just created Windows VM to test against to do what's the idiom for I.

C

Think we probably all do things a little bit differently, I personally spin up a cluster in just in Azure, just on virtual machines with some tooling we have, and but everybody probably does it differently, depending on their preferred stack.

K

A

Yeah I'm tired this fabrikam, that's a great app de la patrie, created I. Remember back in 2016 the first thing we did which actually ported guestbook. So that was the first thing we did, but you know fabrikam might be a better option for you. Yeah.

A

Cool all right, that's it already sorry we're running a little bit late. Everybody have a great rest of your day good week and see you soon right. Yep hi,.