Change:
Kubernetes version (use ): HEAD (~v1.6.0-beta.4) Environment: any What happened: I want to use ClusterFirstWithHostNet which was implemented in , but only dockertools (legacy/non-CRI) was updated to support this feature. The CRI dockershim should be modified to support this rewriting the file of Pods with HostNetwork=true as well. This is a bug in v1.6, I hope it can be prioritized to be fixed in v1.6.1, since it's blocking me from using CRI. Since CRI is enabled by default, it's expected that it should have feature parity with the earlier implementation.
Related
- I guess I didn't realize these crossed paths. Do you have time to take a look?
Will take a look
Thanks! Ping me directly on this.
Filed for supporting it in CRI.

Discussion:
if err != nil { return createResp.ID, fmt.Errorf("failed to start sandbox container for pod %q: %v", config.Metadata.Name, err) } <ins> // Rewrite resolv.conf file generated by docker. // NOTE: cluster dns settings aren't passed anymore to docker api in all cases, // not only for pods with host network: the resolver conf will be overwritten // after sandbox creation to override docker's behaviour. This resolv.conf // file is shared by all containers of the same pod, and needs to be modified // only once per pod. if dnsConfig := config.GetDnsConfig(); dnsConfig != nil { containerInfo, err := ds.client.InspectContainer(createResp.ID) if err != nil { return createResp.ID, fmt.Errorf("failed to inspect sandbox container for pod %q: %v", config.Metadata.Name, err) } if err := dockertools.RewriteResolvFile(containerInfo.ResolvConfPath, dnsConfig.Servers, dnsConfig.Searches, len(dnsConfig.Options) > 0); err != nil { return createResp.ID, fmt.Errorf("rewrite resolf.conf faield for pod %q: %v", config.Metadata.Name, err) } } // Do not invoke network plugins if in hostNetwork mode. </ins> if nsOptions := config.GetLinux().GetSecurityContext().GetNamespaceOptions(); nsOptions != nil && nsOptions.HostNetwork { return createResp.ID, nil }

createConfig.Config.ExposedPorts = exposedPorts hc.PortBindings = portBindings <del> // Set DNS options. if dnsConfig := c.GetDnsConfig(); dnsConfig != nil { hc.DNS = dnsConfig.Servers hc.DNSSearch = dnsConfig.Searches hc.DNSOptions = dnsConfig.Options } </del> // Apply resource options. setSandboxResources(hc)

// we modify it when the pause container is created since it is the first container created in the pod since it holds // the networking namespace. if container.Name == PodInfraContainerName { <del> if err := rewriteResolvFile(containerInfo.ResolvConfPath, opts.DNS, opts.DNSSearch, useClusterFirstPolicy); err != nil { </del> <ins> if err := RewriteResolvFile(containerInfo.ResolvConfPath, opts.DNS, opts.DNSSearch, useClusterFirstPolicy); err != nil { </ins> return kubecontainer.ContainerID{}, err } }

return result, nil } <del> func rewriteResolvFile(resolvFilePath string, dns []string, dnsSearch []string, useClusterFirstPolicy bool) error { </del> <ins> // RewriteResolvFile rewrites resolv.conf file generated by docker. // Exported for reusing in dockershim. func RewriteResolvFile(resolvFilePath string, dns []string, dnsSearch []string, useClusterFirstPolicy bool) error { </ins> if len(resolvFilePath) == 0 { glog.Errorf("ResolvConfPath is empty.") return nil

Annotations: newPodAnnotations(pod), } <ins> dnsServers, dnsSearches, useClusterFirstPolicy, err := m.runtimeHelper.GetClusterDNS(pod) if err != nil { return nil, err } podSandboxConfig.DnsConfig = &runtimeapi.DNSConfig{ Servers:  dnsServers, Searches: dnsSearches, } if useClusterFirstPolicy { podSandboxConfig.DnsConfig.Options = defaultDNSOptions } </ins> if !kubecontainer.IsHostNetworkPod(pod) { <del> dnsServers, dnsSearches, _, err := m.runtimeHelper.GetClusterDNS(pod) if err != nil { return nil, err } podSandboxConfig.DnsConfig = &runtimeapi.DNSConfig{ Servers:  dnsServers, Searches: dnsSearches, Options:  defaultDNSOptions, } </del> // TODO: Add domain support in new runtime interface hostname, _, err := m.runtimeHelper.GeneratePodHostNameAndDomain(pod) if err != nil {