Change:
<!-- This form is for bug reports and feature requests ONLY! If you're looking for help check and the . --Is this a BUG REPORT or FEATURE REQUEST?: What happened: Kubelet is depending on docker container's ResolvConfPath (e.g. ) to setup dns servers and search domains. While this is ok for Linux containers, ResolvConfPath is always an empty string for windows containers. So that the DNS setting for windows containers are always not set. For kubernetes clusters deployed by acs-engine, the Pod's DNS is always set to kube-dns service's clusterIP. This is done via the network plugin (e.g. l2bridge or azure-cni). It makes windows containers only work with ClusterFirst dns policy. To follow kubernetes dns policies, Kubelet should pass the expected DNS settings directly to windows containers (instead of set it in CNI plugins). What you expected to happen: How to reproduce it (as minimally and precisely as possible): Anything else we need to know?: Environment: Kubernetes version (use ): Cloud provider or hardware configuration: OS (e.g. from /etc/os-release): Kernel (e.g. ): Install tools: Others:
/sig windows /sig node /kind bug /assign /cc
Let me fix this in v1.11
/priority important-soon
/status approved-for-milestone
This may have been fixed in
Not same. This is what has done, but it doesn't follow kubernetes dns policies.
status intended for 1.11?
Yep.
/status in-progress
[MILESTONENOTIFIER] Milestone Removed From Issue Important: Code freeze is in effect and only issues with may remain in the v1.11 milestone. <details<summaryHelp</summary<ul<li<a href=""Additional instructions</a</li<li<a href=""Commands for setting labels</a</li</ul</details

Discussion:
] + select({ "@io_bazel_rules_go//go/platform:android": [ "docker_image_unsupported.go", <ins> "docker_sandbox_others.go", </ins> "docker_stats_unsupported.go", "helpers_unsupported.go", ], "@io_bazel_rules_go//go/platform:darwin": [ "docker_image_unsupported.go", <ins> "docker_sandbox_others.go", </ins> "docker_stats_unsupported.go", "helpers_unsupported.go", ], "@io_bazel_rules_go//go/platform:dragonfly": [ "docker_image_unsupported.go", <ins> "docker_sandbox_others.go", </ins> "docker_stats_unsupported.go", "helpers_unsupported.go", ], "@io_bazel_rules_go//go/platform:freebsd": [ "docker_image_unsupported.go", <ins> "docker_sandbox_others.go", </ins> "docker_stats_unsupported.go", "helpers_unsupported.go", ], "@io_bazel_rules_go//go/platform:linux": [ "docker_image_linux.go", <ins> "docker_sandbox_others.go", </ins> "docker_stats_linux.go", "helpers_linux.go", ], "@io_bazel_rules_go//go/platform:nacl": [ "docker_image_unsupported.go", <ins> "docker_sandbox_others.go", </ins> "docker_stats_unsupported.go", "helpers_unsupported.go", ], "@io_bazel_rules_go//go/platform:netbsd": [ "docker_image_unsupported.go", <ins> "docker_sandbox_others.go", </ins> "docker_stats_unsupported.go", "helpers_unsupported.go", ], "@io_bazel_rules_go//go/platform:openbsd": [ "docker_image_unsupported.go", <ins> "docker_sandbox_others.go", </ins> "docker_stats_unsupported.go", "helpers_unsupported.go", ], "@io_bazel_rules_go//go/platform:plan9": [ "docker_image_unsupported.go", <ins> "docker_sandbox_others.go", </ins> "docker_stats_unsupported.go", "helpers_unsupported.go", ], "@io_bazel_rules_go//go/platform:solaris": [ "docker_image_unsupported.go", <ins> "docker_sandbox_others.go", </ins> "docker_stats_unsupported.go", "helpers_unsupported.go", ], "@io_bazel_rules_go//go/platform:windows": [ "docker_image_windows.go", <ins> "docker_sandbox_windows.go", </ins> "docker_stats_windows.go", "helpers_windows.go", ],

return &runtimeapi.ListPodSandboxResponse{Items: result}, nil } <del> // applySandboxLinuxOptions applies LinuxPodSandboxConfig to dockercontainer.HostConfig and dockercontainer.ContainerCreateConfig. func (ds *dockerService) applySandboxLinuxOptions(hc *dockercontainer.HostConfig, lc *runtimeapi.LinuxPodSandboxConfig, createConfig *dockertypes.ContainerCreateConfig, image string, separator rune) error { if lc == nil { return nil } // Apply security context. if err := applySandboxSecurityContext(lc, createConfig.Config, hc, ds.network, separator); err != nil { return err } // Set sysctls. hc.Sysctls = lc.Sysctls return nil } </del> func (ds *dockerService) applySandboxResources(hc *dockercontainer.HostConfig, lc *runtimeapi.LinuxPodSandboxConfig) error { hc.Resources = dockercontainer.Resources{ MemorySwap: DefaultMemorySwap(),

HostConfig: hc, } <del> // Apply linux-specific options. if err := ds.applySandboxLinuxOptions(hc, c.GetLinux(), createConfig, image, securityOptSeparator); err != nil { </del> <ins> // Apply platform-specific options. if err := ds.applySandboxPlatformOptions(hc, c, createConfig, image, securityOptSeparator); err != nil { </ins> return nil, err }

<ins> // +build !windows /* Copyright 2018 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ package dockershim import ( dockertypes "github.com/docker/docker/api/types" dockercontainer "github.com/docker/docker/api/types/container" runtimeapi "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2" ) // applySandboxPlatformOptions applies platform specific options to dockercontainer.HostConfig and dockercontainer.ContainerCreateConfig. func (ds *dockerService) applySandboxPlatformOptions(hc *dockercontainer.HostConfig, config *runtimeapi.PodSandboxConfig, createConfig *dockertypes.ContainerCreateConfig, image string, separator rune) error { lc := config.GetLinux() if lc == nil { return nil } // Apply security context. if err := applySandboxSecurityContext(lc, createConfig.Config, hc, ds.network, separator); err != nil { return err } // Set sysctls. hc.Sysctls = lc.Sysctls return nil } </ins>

<ins> // +build windows /* Copyright 2018 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ package dockershim import ( dockertypes "github.com/docker/docker/api/types" dockercontainer "github.com/docker/docker/api/types/container" runtimeapi "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2" ) // applySandboxPlatformOptions applies platform specific options to dockercontainer.HostConfig and dockercontainer.ContainerCreateConfig. func (ds *dockerService) applySandboxPlatformOptions(hc *dockercontainer.HostConfig, config *runtimeapi.PodSandboxConfig, createConfig *dockertypes.ContainerCreateConfig, image string, separator rune) error { dnsConfig := config.GetDnsConfig() if dnsConfig == nil { return nil } // Setup DNS. hc.DNS = dnsConfig.GetServers() hc.DNSSearch = dnsConfig.GetSearches() hc.DNSOptions = dnsConfig.GetOptions() return nil } </ins>