Skip to content

Commit af2f72a

Browse files
brasmith-msliggittmarossetTim Bannisterjsturtevant
authored
Windows HostProcess Container Documentation (#28413)
* Rebasing HostProcess security changes. * Incorporated initial round of feedback * Minor wording updates * Finished up remaining todo items * Apply suggestions from code review Co-authored-by: Jordan Liggitt <[email protected]> Co-authored-by: Mark Rossetti <[email protected]> * Moved HostProcess security documentation into PSS and create-host-process-pod docs * Updated with for James' review * Apply suggestions from code review Co-authored-by: Tim Bannister <[email protected]> Co-authored-by: James Sturtevant <[email protected]> * Minor edits * Modifications for additional feedback Co-authored-by: Jordan Liggitt <[email protected]> Co-authored-by: Mark Rossetti <[email protected]> Co-authored-by: Tim Bannister <[email protected]> Co-authored-by: James Sturtevant <[email protected]>
1 parent acc7252 commit af2f72a

File tree

4 files changed

+247
-5
lines changed

4 files changed

+247
-5
lines changed

content/en/docs/concepts/security/pod-security-standards.md

Lines changed: 28 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,24 @@ fail validation.
5555
<td><strong>Control</strong></td>
5656
<td><strong>Policy</strong></td>
5757
</tr>
58+
<tr>
59+
<td style="white-space: nowrap">HostProcess</td>
60+
<td>
61+
<p>Windows pods offer the ability to run <a href="/docs/tasks/configure-pod-container/create-hostprocess-pod">HostProcess containers</a> which enables privileged access to the Windows node. Privileged access to the host is disallowed in the baseline policy. HostProcess pods are an <strong>alpha</strong> feature as of Kubernetes <strong>v1.22</strong>.</p>
62+
<p><strong>Restricted Fields</strong></p>
63+
<ul>
64+
<li><code>spec.securityContext.windowsOptions.hostProcess</code></li>
65+
<li><code>spec.containers[*].securityContext.windowsOptions.hostProcess</code></li>
66+
<li><code>spec.initContainers[*].securityContext.windowsOptions.hostProcess</code></li>
67+
<li><code>spec.ephemeralContainers[*].securityContext.windowsOptions.hostProcess</code></li>
68+
</ul>
69+
<p><strong>Allowed Values</strong></p>
70+
<ul>
71+
<li>Undefined/nil</li>
72+
<li><code>false</code></li>
73+
</ul>
74+
</td>
75+
</tr>
5876
<tr>
5977
<td style="white-space: nowrap">Host Namespaces</td>
6078
<td>
@@ -483,10 +501,19 @@ ecosystem, such as [OPA Gatekeeper](https://github.com/open-profile-agent/gateke
483501
### What profiles should I apply to my Windows Pods?
484502

485503
Windows in Kubernetes has some limitations and differentiators from standard Linux-based
486-
workloads. Specifically, the Pod SecurityContext fields [have no effect on
504+
workloads. Specifically, many of the Pod SecurityContext fields [have no effect on
487505
Windows](/docs/setup/production-environment/windows/intro-windows-in-kubernetes/#v1-podsecuritycontext). As
488506
such, no standardized Pod Security profiles currently exist.
489507

508+
If you apply the restricted profile for a Windows pod, this **may** have an impact on the pod
509+
at runtime. The restricted profile requires enforcing Linux-specific restrictions (such as seccomp
510+
profile, and disallowing privilege escalation). If the kubelet and / or its container runtime ignore
511+
these Linux-specific values, then the Windows pod should still work normally within the restricted
512+
profile. However, the lack of enforcement means that there is no additional restriction, for Pods
513+
that use Windows containers, compared to the baseline profile.
514+
515+
The use of the HostProcess flag to create a HostProcess pod should only be done in alignment with the privileged policy. Creation of a Windows HostProcess pod is blocked under the baseline and restricted policies, so any HostProcess pod should be considered privileged.
516+
490517
### What about sandboxed Pods?
491518

492519
There is not currently an API standard that controls whether a Pod is considered sandboxed or
@@ -499,5 +526,3 @@ kernel. This allows for workloads requiring heightened permissions to still be i
499526

500527
Additionally, the protection of sandboxed workloads is highly dependent on the method of
501528
sandboxing. As such, no single recommended profile is recommended for all sandboxed workloads.
502-
503-

content/en/docs/concepts/workloads/pods/_index.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -257,8 +257,9 @@ section.
257257

258258
## Privileged mode for containers
259259

260-
Any container in a Pod can enable privileged mode, using the `privileged` flag on the [security context](/docs/tasks/configure-pod-container/security-context/) of the container spec. This is useful for containers that want to use operating system administrative capabilities such as manipulating the network stack or accessing hardware devices.
261-
Processes within a privileged container get almost the same privileges that are available to processes outside a container.
260+
In Linux, any container in a Pod can enable privileged mode using the `privileged` (Linux) flag on the [security context](/docs/tasks/configure-pod-container/security-context/) of the container spec. This is useful for containers that want to use operating system administrative capabilities such as manipulating the network stack or accessing hardware devices.
261+
262+
If your cluster has the `WindowsHostProcessContainers` feature enabled, you can create a [Windows HostProcess pod](/docs/tasks/configure-pod-container/create-hostprocess-pod) by setting the `windowsOptions.hostProcess` flag on the security context of the pod spec. All containers in these pods must run as Windows HostProcess containers. HostProcess pods run directly on the host and can also be used to perform administrative tasks as is done with Linux privileged containers.
262263

263264
{{< note >}}
264265
Your {{< glossary_tooltip text="container runtime" term_id="container-runtime" >}} must support the concept of a privileged container for this setting to be relevant.

content/en/docs/reference/command-line-tools-reference/feature-gates.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -460,6 +460,7 @@ different Kubernetes components.
460460
| `WindowsGMSA` | `false` | Alpha | 1.14 | 1.15 |
461461
| `WindowsGMSA` | `true` | Beta | 1.16 | 1.17 |
462462
| `WindowsGMSA` | `true` | GA | 1.18 | - |
463+
| `WindowsHostProcessContainers` | `false` | Alpha | 1.22 |
463464
| `WindowsRunAsUserName` | `false` | Alpha | 1.16 | 1.16 |
464465
| `WindowsRunAsUserName` | `true` | Beta | 1.17 | 1.17 |
465466
| `WindowsRunAsUserName` | `true` | GA | 1.18 | - |
@@ -987,6 +988,7 @@ Each feature gate is designed for enabling/disabling a specific feature:
987988
- `WinDSR`: Allows kube-proxy to create DSR loadbalancers for Windows.
988989
- `WinOverlay`: Allows kube-proxy to run in overlay mode for Windows.
989990
- `WindowsGMSA`: Enables passing of GMSA credential specs from pods to container runtimes.
991+
- `WindowsHostProcessContainers`: Enables support for Windows HostProcess containers.
990992
- `WindowsRunAsUserName` : Enable support for running applications in Windows containers
991993
with as a non-default user. See
992994
[Configuring RunAsUserName](/docs/tasks/configure-pod-container/configure-runasusername)
Lines changed: 214 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,214 @@
1+
---
2+
title: Create a Windows HostProcess Pod
3+
content_type: task
4+
weight: 20
5+
min-kubernetes-server-version: 1.22
6+
---
7+
8+
<!-- overview -->
9+
10+
{{< feature-state for_k8s_version="v1.22" state="alpha" >}}
11+
12+
Windows HostProcess containers enable you to run containerized
13+
workloads on a Windows host. These containers operate as
14+
normal processes but have access to the host network namespace,
15+
storage, and devices when given the appropriate user privileges.
16+
HostProcess containers can be used to deploy network plugins,
17+
storage configurations, device plugins, kube-proxy, and other
18+
components to Windows nodes without the need for dedicated proxies or
19+
the direct installation of host services.
20+
21+
Administrative tasks such as installation of security patches, event
22+
log collection, and more can be performed without requiring cluster operators to
23+
log onto each Window node. HostProcess containers can run as any user that is
24+
available on the host or is in the domain of the host machine, allowing administrators
25+
to restrict resource access through user permissions. While neither filesystem or process
26+
isolation are supported, a new volume is created on the host upon starting the container
27+
to give it a clean and consolidated workspace. HostProcess containers can also be built on
28+
top of existing Windows base images and do not inherit the same
29+
[compatibility requirements](https://docs.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility)
30+
as Windows server containers, meaning that the version of the base images does not need
31+
to match that of the host. HostProcess containers also support
32+
[volume mounts](./create-hostprocess-pod#volume-mounts) within the container volume.
33+
34+
### When should I use a Windows HostProcess container?
35+
36+
- When you need to perform tasks which require the networking namespace of the host.
37+
HostProcess containers have access to the host's network interfaces and IP addresses.
38+
- You need access to resources on the host such as the filesystem, event logs, etc.
39+
- Installation of specific device drivers or Windows services.
40+
- Consolidation of administrative tasks and security policies. This reduces the degree of
41+
privileges needed by Windows nodes.
42+
43+
44+
## {{% heading "prerequisites" %}}
45+
46+
{{% version-check %}}
47+
48+
To enable HostProcess containers while in Alpha you need to pass the following feature gate flag to
49+
**kubelet** and **kube-apiserver**.
50+
See [Features Gates](https://kubernetes.io/docs/reference/command-line-tools-reference/feature-gates/#overview)
51+
documentation for more details.
52+
53+
```
54+
--feature-gates=WindowsHostProcessContainers=true
55+
```
56+
57+
You can use the latest version of Containerd (v1.5.4+) with the following settings using the containerd
58+
v2 configuration. Add these annotations to any runtime configurations were you wish to enable the
59+
HostProcess container feature.
60+
61+
62+
```
63+
[plugins]
64+
[plugins."io.containerd.grpc.v1.cri"]
65+
[plugins."io.containerd.grpc.v1.cri".containerd]
66+
[plugins."io.containerd.grpc.v1.cri".containerd.default_runtime]
67+
container_annotations = ["microsoft.com/hostprocess-container"]
68+
pod_annotations = ["microsoft.com/hostprocess-container"]
69+
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes]
70+
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runhcs-wcow-process]
71+
container_annotations = ["microsoft.com/hostprocess-container"]
72+
pod_annotations = ["microsoft.com/hostprocess-container"]
73+
```
74+
75+
The current versions of containerd ship with a version of hcsshim that does not have support.
76+
You will need to build a version of hcsshim from the main branch following the
77+
[instructions in hcsshim](https://github.com/Microsoft/hcsshim/#containerd-shim).
78+
Once the containerd shim is built you can replace the file in your contianerd installation.
79+
For example if you followed the instructions to
80+
[install containerd](/docs/setup/production-environment/container-runtimes/#containerd)
81+
replace the `containerd-shim-runhcs-v1.exe` is installed at `$Env:ProgramFiles\containerd` with the newly built shim.
82+
83+
## Limitations
84+
85+
- HostProcess containers require version 1.5.4 or higher of the containerd {{< glossary_tooltip text="container runtime" term_id="container-runtime" >}}.
86+
- As of v1.22 HostProcess pods can only contain HostProcess containers. This is a current limitation
87+
of the Windows OS; non-privileged Windows containers cannot share a vNIC with the host IP namespace.
88+
- HostProcess containers run as a process on the host and do not have any degree of
89+
isolation other than resource constraints imposed on the HostProcess user account. Neither
90+
filesystem or Hyper-V isolation are supported for HostProcess containers.
91+
- Volume mounts are supported and are mounted under the container volume.
92+
See [Volume Mounts](#volume-mounts)
93+
- A limited set of host user accounts are available for HostProcess containers by default.
94+
See [Choosing a User Account](#choosing-a-user-account).
95+
- Resource limits (disk, memory, cpu count) are supported in the same fashion as processes
96+
on the host.
97+
- Both Named pipe mounts and Unix domain sockets are **not** currently supported and should instead
98+
be accessed via their path on the host (e.g. \\\\.\\pipe\\\*)
99+
100+
## HostProcess Pod configuration requirements
101+
102+
Enabling a Windows HostProcess pod requires setting the right configurations in the pod security
103+
configuration. Of the policies defined in the [Pod Security Standards](/docs/concepts/security/pod-security-standards)
104+
HostProcess pods are disallowed by the baseline and restricted policies. It is therefore recommended
105+
that HostProcess pods run in alignment with the privileged profile.
106+
107+
When running under the privileged policy, here are
108+
the configurations which need to be set to enable the creation of a HostProcess pod:
109+
110+
<table>
111+
<caption style="display:none">Privileged policy specification</caption>
112+
<tbody>
113+
<tr>
114+
<td><strong>Control</strong></td>
115+
<td><strong>Policy</strong></td>
116+
</tr>
117+
<tr>
118+
<td style="white-space: nowrap"><a href="/docs/concepts/security/pod-security-standards">Windows HostProcess</a></td>
119+
<td>
120+
<p>Windows pods offer the ability to run <a href="/docs/tasks/configure-pod-container/create-hostprocess-pod">
121+
HostProcess containers</a> which enables privileged access to the Windows node. </p>
122+
<p><strong>Allowed Values</strong></p>
123+
<ul>
124+
<li><code>true</code></li>
125+
</ul>
126+
</td>
127+
</tr>
128+
<tr>
129+
<td style="white-space: nowrap"><a href="/docs/concepts/security/pod-security-standards">Host Networking</a></td>
130+
<td>
131+
<p>Will be in host network by default initially. Support
132+
to set network to a different compartment may be desirable in
133+
the future.</p>
134+
<p><strong>Allowed Values</strong></p>
135+
<ul>
136+
<li><code>true</code></li>
137+
</ul>
138+
</td>
139+
</tr>
140+
<tr>
141+
<td style="white-space: nowrap"><a href="/docs/tasks/configure-pod-container/configure-runasusername/">runAsUsername</a></td>
142+
<td>
143+
<p>Specification of which user the HostProcess container should run as is required for the pod spec.</p>
144+
<p><strong>Allowed Values</strong></p>
145+
<ul>
146+
<li><code>NT AUTHORITY\SYSTEM</code></li>
147+
<li><code>NT AUTHORITY\Local service</code></li>
148+
<li><code>NT AUTHORITY\NetworkService</code></li>
149+
</ul>
150+
</td>
151+
</tr>
152+
<tr>
153+
<td style="white-space: nowrap"><a href="/docs/concepts/security/pod-security-standards">runAsNonRoot</a></td>
154+
<td>
155+
<p>Because HostProcess containers have privileged access to the host, the <tt>runAsNonRoot</tt> field cannot be set to true.</p>
156+
<p><strong>Allowed Values</strong></p>
157+
<ul>
158+
<li>Undefined/Nil</li>
159+
<li><code>false</code></li>
160+
</ul>
161+
</td>
162+
</tr>
163+
</tbody>
164+
</table>
165+
166+
### Example Manifest (excerpt)
167+
168+
```yaml
169+
spec:
170+
securityContext:
171+
windowsOptions:
172+
hostProcess: true
173+
runAsUserName: "NT AUTHORITY\\Local service"
174+
hostNetwork: true
175+
containers:
176+
- name: test
177+
image: image1:latest
178+
command:
179+
- ping
180+
- -t
181+
- 127.0.0.1
182+
nodeSelector:
183+
"kubernetes.io/os": windows
184+
```
185+
186+
## Volume Mounts
187+
188+
HostProcess containers support the ability to mount volumes within the container volume space.
189+
Applications running inside the container can access volume mounts directly via relative or
190+
absolute paths. An environment variable `$CONTAINER_SANDBOX_MOUNT_POINT` is set upon container
191+
creation and provides the absolute host path to the container volume. Relative paths are based
192+
upon the `Pod.containers.volumeMounts.mountPath` configuration.
193+
194+
### Example {#volume-mount-example}
195+
196+
To access service account tokens the following path structures are supported within the container:
197+
198+
`.\var\run\secrets\kubernetes.io\serviceaccount\`
199+
200+
`$CONTAINER_SANDBOX_MOUNT_POINT\var\run\secrets\kubernetes.io\serviceaccount\`
201+
202+
## Choosing a User Account
203+
204+
HostProcess containers support the ability to run as one of three supported Windows service accounts:
205+
206+
- **[LocalSystem](https://docs.microsoft.com/en-us/windows/win32/services/localsystem-account)**
207+
- **[LocalService](https://docs.microsoft.com/en-us/windows/win32/services/localservice-account)**
208+
- **[NetworkService](https://docs.microsoft.com/en-us/windows/win32/services/networkservice-account)**
209+
210+
You should select an appropriate Windows service account for each HostProcess
211+
container, aiming to limit the degree of privileges so as to avoid accidental (or even
212+
malicious) damage to the host. The LocalSystem service account has the highest level
213+
of privilege of the three and should be used only if absolutely necessary. Where possible,
214+
use the LocalService service account as it is the least privileged of the three options.

0 commit comments

Comments
 (0)