kubernetes: Windows Hostprocess containers can't use the InClientConfig for api access
What happened:
If you try to access the api service using Inclusterconfig with Windows hostprocess container you get an error:
open /var/run/secrets/kubernetes.io/serviceaccount/token: The system cannot find the path specified.
What you expected to happen:
Should be able to connect to the API server. This is common scenario for kube-proxy and CNIs.
How to reproduce it (as minimally and precisely as possible):
apiVersion: v1
kind: Pod
metadata:
name: hostprocess-agnhost-older-client
spec:
securityContext:
windowsOptions:
hostProcess: true
runAsUserName: "NT AUTHORITY\\SYSTEM"
hostNetwork: true
containers:
- name: test
imagePullPolicy: Always
image: k8s.gcr.io/e2e-test-images/agnhost:2.32
command:
- powershell
- -c
- start-process
- "-wait"
- "-nonewwindow"
- "$env:CONTAINER_SANDBOX_MOUNT_POINT\\agnhost"
args:
- "inclusterclient --poll-interval 5"
restartPolicy: Always
nodeSelector:
"kubernetes.io/os": windows
tolerations:
- key: ""
operator: "Exists"
effect: "NoSchedule"
---
kubectl logs hostprocess-agnhost-older-client
I0825 00:12:40.693662 5192 main.go:61] started
I0825 00:12:40.758659 5192 log.go:184] err: open /var/run/secrets/kubernetes.io/serviceaccount/token: The system cannot find the path specified.
Anything else we need to know?:
Environment:
- Kubernetes version (use
kubectl version): - Cloud provider or hardware configuration:
- OS (e.g:
cat /etc/os-release): - Kernel (e.g.
uname -a): - Install tools:
- Network plugin and version (if this is a network-related bug):
- Others:
/sig windows /sig cli
About this issue
- Original URL
- State: closed
- Created 3 years ago
- Comments: 18 (13 by maintainers)
This is working but requires containerd v1.7
https://testgrid.k8s.io/sig-windows-master-release#capz-windows-containerd-nightly-master&include-filter-by-regex=in-cluster