kubernetes: Windows Hostprocess containers can't use the InClientConfig for api access

What happened:

If you try to access the api service using Inclusterconfig with Windows hostprocess container you get an error:

open /var/run/secrets/kubernetes.io/serviceaccount/token: The system cannot find the path specified.

What you expected to happen:

Should be able to connect to the API server. This is common scenario for kube-proxy and CNIs.

How to reproduce it (as minimally and precisely as possible):

apiVersion: v1
kind: Pod
metadata:
  name: hostprocess-agnhost-older-client
spec:
  securityContext:
    windowsOptions:
      hostProcess: true
      runAsUserName: "NT AUTHORITY\\SYSTEM"
  hostNetwork: true
  containers:
  - name: test
    imagePullPolicy: Always
    image: k8s.gcr.io/e2e-test-images/agnhost:2.32
    command:
      - powershell
      - -c
      - start-process
      - "-wait"
      - "-nonewwindow"
      - "$env:CONTAINER_SANDBOX_MOUNT_POINT\\agnhost"
    args:
      - "inclusterclient --poll-interval 5"
  restartPolicy: Always
  nodeSelector:
    "kubernetes.io/os": windows
  tolerations:
    - key: ""
      operator: "Exists"
      effect: "NoSchedule"
---
kubectl logs hostprocess-agnhost-older-client
I0825 00:12:40.693662    5192 main.go:61] started
I0825 00:12:40.758659    5192 log.go:184] err: open /var/run/secrets/kubernetes.io/serviceaccount/token: The system cannot find the path specified.

Anything else we need to know?:

Environment:

  • Kubernetes version (use kubectl version):
  • Cloud provider or hardware configuration:
  • OS (e.g: cat /etc/os-release):
  • Kernel (e.g. uname -a):
  • Install tools:
  • Network plugin and version (if this is a network-related bug):
  • Others:

/sig windows /sig cli

About this issue

  • Original URL
  • State: closed
  • Created 3 years ago
  • Comments: 18 (13 by maintainers)

Most upvoted comments