Skip to content

Commit 8983d73

Browse files
author
Tim Bannister
authored
Tidy HostProcess task page (#30762)
* Tidy HostProcess task page * Use spaces for indentation Tabs for indentation are less easy to work with between different contributors. Switch to spaces. * Fix table for HostProcess requirements
1 parent 3a30941 commit 8983d73

File tree

1 file changed

+72
-63
lines changed

1 file changed

+72
-63
lines changed

‎content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md

Lines changed: 72 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Create a Windows HostProcess Pod
33
content_type: task
44
weight: 20
5-
min-kubernetes-server-version: 1.22
5+
min-kubernetes-server-version: 1.23
66
---
77

88
<!-- overview -->
@@ -43,9 +43,15 @@ HostProcess containers have access to the host's network interfaces and IP addre
4343
privileges needed by Windows nodes.
4444

4545

46-
## {{% heading "prerequisites" %}}% version-check %}}
46+
## {{% heading "prerequisites" %}}
4747

48-
In 1.23 the HostProcess container feature is enabled by default. The kubelet will
48+
<!-- change this when graduating to stable -->
49+
50+
This task guide is specific to Kubernetes v{{< skew currentVersion >}}.
51+
If you are not running Kubernetes v{{< skew currentVersion >}}, check the documentation for
52+
that version of Kubernetes.
53+
54+
In Kubernetes {{< skew currentVersion >}}, the HostProcess container feature is enabled by default. The kubelet will
4955
communicate with containerd directly by passing the hostprocess flag via CRI. You can use the
5056
latest version of containerd (v1.6+) to run HostProcess containers.
5157
[How to install containerd.](/docs/setup/production-environment/container-runtimes/#containerd)
@@ -64,20 +70,21 @@ documentation for more details.
6470

6571
## Limitations
6672

73+
These limitations are relevant for Kubernetes v{{< skew currentVersion >}}:
74+
6775
- HostProcess containers require containerd 1.6 or higher
6876
{{< glossary_tooltip text="container runtime" term_id="container-runtime" >}}.
69-
- As of v1.23 HostProcess pods can only contain HostProcess containers. This is a current limitation
77+
- HostProcess pods can only contain HostProcess containers. This is a current limitation
7078
of the Windows OS; non-privileged Windows containers cannot share a vNIC with the host IP namespace.
7179
- HostProcess containers run as a process on the host and do not have any degree of
7280
isolation other than resource constraints imposed on the HostProcess user account. Neither
7381
filesystem or Hyper-V isolation are supported for HostProcess containers.
7482
- Volume mounts are supported and are mounted under the container volume. See [Volume Mounts](#volume-mounts)
75-
- As of 1.23, a limited set of host user accounts are available for HostProcess containers by default.
7683
- A limited set of host user accounts are available for HostProcess containers by default.
77-
See [Choosing a User Account](#choosing-a-user-account).
84+
See [Choosing a User Account](#choosing-a-user-account).
7885
- Resource limits (disk, memory, cpu count) are supported in the same fashion as processes
7986
on the host.
80-
- Both Named pipe mounts and Unix domain sockets are **not** currently supported and should instead
87+
- Both Named pipe mounts and Unix domain sockets are **not** supported and should instead
8188
be accessed via their path on the host (e.g. \\\\.\\pipe\\\*)
8289

8390
## HostProcess Pod configuration requirements
@@ -91,62 +98,64 @@ When running under the privileged policy, here are
9198
the configurations which need to be set to enable the creation of a HostProcess pod:
9299

93100
<table>
94-
<caption style="display:none">Privileged policy specification</caption>
95-
<tbody>
96-
<tr>
97-
<td><strong>Control</strong></td>
98-
<td><strong>Policy</strong></td>
99-
</tr>
100-
<tr>
101-
<td style="white-space: nowrap"><a href="/docs/concepts/security/pod-security-standards">Windows HostProcess</a></td>
102-
<td>
103-
<p>Windows pods offer the ability to run <a href="/docs/tasks/configure-pod-container/create-hostprocess-pod">
101+
<caption style="display: none">Privileged policy specification</caption>
102+
<thead>
103+
<tr>
104+
<th>Control</th>
105+
<th>Policy</th>
106+
</tr>
107+
</thead>
108+
<tbody>
109+
<tr>
110+
<td style="white-space: nowrap"><a href="/docs/concepts/security/pod-security-standards"><tt>securityContext.windowsOptions.hostProcess</tt></a></td>
111+
<td>
112+
<p>Windows pods offer the ability to run <a href="/docs/tasks/configure-pod-container/create-hostprocess-pod">
104113
HostProcess containers</a> which enables privileged access to the Windows node. </p>
105-
<p><strong>Allowed Values</strong></p>
106-
<ul>
107-
<li><code>true</code></li>
108-
</ul>
109-
</td>
110-
</tr>
111-
<tr>
112-
<td style="white-space: nowrap"><a href="/docs/concepts/security/pod-security-standards">Host Networking</a></td>
113-
<td>
114-
<p>Will be in host network by default initially. Support
115-
to set network to a different compartment may be desirable in
116-
the future.</p>
117-
<p><strong>Allowed Values</strong></p>
118-
<ul>
119-
<li><code>true</code></li>
120-
</ul>
121-
</td>
122-
</tr>
114+
<p><strong>Allowed Values</strong></p>
115+
<ul>
116+
<li><code>true</code></li>
117+
</ul>
118+
</td>
119+
</tr>
120+
<tr>
121+
<td style="white-space: nowrap"><a href="/docs/concepts/security/pod-security-standards"><tt>hostNetwork</tt></a></td>
122+
<td>
123+
<p>Will be in host network by default initially. Support
124+
to set network to a different compartment may be desirable in
125+
the future.</p>
126+
<p><strong>Allowed Values</strong></p>
127+
<ul>
128+
<li><code>true</code></li>
129+
</ul>
130+
</td>
131+
</tr>
123132
<tr>
124-
<td style="white-space: nowrap"><a href="/docs/tasks/configure-pod-container/configure-runasusername/">runAsUsername</a></td>
125-
<td>
126-
<p>Specification of which user the HostProcess container should run as is required for the pod spec.</p>
127-
<p><strong>Allowed Values</strong></p>
128-
<ul>
129-
<li><code>NT AUTHORITY\SYSTEM</code></li>
130-
<li><code>NT AUTHORITY\Local service</code></li>
131-
<li><code>NT AUTHORITY\NetworkService</code></li>
132-
</ul>
133-
</td>
134-
</tr>
133+
<td style="white-space: nowrap"><a href="/docs/tasks/configure-pod-container/configure-runasusername/"><tt>securityContext.windowsOptions.runAsUsername</tt></a></td>
134+
<td>
135+
<p>Specification of which user the HostProcess container should run as is required for the pod spec.</p>
136+
<p><strong>Allowed Values</strong></p>
137+
<ul>
138+
<li><code>NT AUTHORITY\SYSTEM</code></li>
139+
<li><code>NT AUTHORITY\Local service</code></li>
140+
<li><code>NT AUTHORITY\NetworkService</code></li>
141+
</ul>
142+
</td>
143+
</tr>
135144
<tr>
136-
<td style="white-space: nowrap"><a href="/docs/concepts/security/pod-security-standards">runAsNonRoot</a></td>
137-
<td>
138-
<p>Because HostProcess containers have privileged access to the host, the <tt>runAsNonRoot</tt> field cannot be set to true.</p>
139-
<p><strong>Allowed Values</strong></p>
140-
<ul>
145+
<td style="white-space: nowrap"><a href="/docs/concepts/security/pod-security-standards"><tt>runAsNonRoot</tt></a></td>
146+
<td>
147+
<p>Because HostProcess containers have privileged access to the host, the <tt>runAsNonRoot</tt> field cannot be set to true.</p>
148+
<p><strong>Allowed Values</strong></p>
149+
<ul>
141150
<li>Undefined/Nil</li>
142-
<li><code>false</code></li>
143-
</ul>
144-
</td>
145-
</tr>
146-
</tbody>
151+
<li><code>false</code></li>
152+
</ul>
153+
</td>
154+
</tr>
155+
</tbody>
147156
</table>
148157

149-
### Example Manifest (excerpt)
158+
### Example manifest (excerpt) {#manifest-example}
150159

151160
```yaml
152161
spec:
@@ -166,13 +175,13 @@ spec:
166175
"kubernetes.io/os": windows
167176
```
168177
169-
## Volume Mounts
178+
## Volume mounts
170179
171180
HostProcess containers support the ability to mount volumes within the container volume space.
172181
Applications running inside the container can access volume mounts directly via relative or
173-
absolute paths. As of v1.23, an environment variable `$CONTAINER_SANDBOX_MOUNT_POINT` is set upon container
182+
absolute paths. An environment variable `$CONTAINER_SANDBOX_MOUNT_POINT` is set upon container
174183
creation and provides the absolute host path to the container volume. Relative paths are based
175-
upon the `Pod.containers.volumeMounts.mountPath` configuration.
184+
upon the `.spec.containers.volumeMounts.mountPath` configuration.
176185

177186
### Example {#volume-mount-example}
178187

@@ -182,7 +191,7 @@ To access service account tokens the following path structures are supported wit
182191
183192
`$CONTAINER_SANDBOX_MOUNT_POINT\var\run\secrets\kubernetes.io\serviceaccount\`
184193

185-
## Resource Limits
194+
## Resource limits
186195

187196
Resource limits (disk, memory, cpu count) are applied to the job and are job wide.
188197
For example, with a limit of 10MB set, the memory allocated for any HostProcess job object
@@ -191,9 +200,9 @@ These limits would be specified the same way they are currently for whatever orc
191200
or runtime is being used. The only difference is in the disk resource usage calculation
192201
used for resource tracking due to the difference in how HostProcess containers are bootstrapped.
193202

194-
## Choosing a User Account
203+
## Choosing a user account
195204

196-
As of 1.23, HostProcess containers support the ability to run as one of three supported Windows service accounts:
205+
HostProcess containers support the ability to run as one of three supported Windows service accounts:
197206

198207
- **[LocalSystem](https://docs.microsoft.com/windows/win32/services/localsystem-account)**
199208
- **[LocalService](https://docs.microsoft.com/windows/win32/services/localservice-account)**

0 commit comments

Comments
 (0)