Explain use of pod os field #35439

ravisantoshgudimetla · 2022-07-27T12:58:58Z

Identify OS authoritatively during pod admission time using pod.OS field

netlify · 2022-07-27T13:09:13Z

✅ Pull request preview available for checking

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`266d6c3`
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/63eebba2e5bf40000807dcd1
😎 Deploy Preview	https://deploy-preview-35439--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site settings.

sftim · 2022-07-27T13:27:30Z

/retitle [WIP] Explain use of pod os field

katcosgrove · 2022-08-12T14:46:41Z

Hi from the Comms team! Just a reminder that the Ready to Review deadline for feature blogs is Tuesday, August 16. You will also be assigned a publication date post-release. Is there anything we can do to help you right now?

jsturtevant · 2022-08-12T15:45:09Z

content/en/blog/_posts/2022-07-27-pod-os-field/index.md

+onto the container runtime, it'd be better to identify the OS early in the life-cycle of pod and use the 
+identification mechanism consistently across all kubernetes components including `kubelet`. 
+With that in mind, `OS` field has been added to the pod spec in 1.23 release of kubernetes as an 
+alpha feature and it graduated to stable in 1.25.`PodSecurity` admission plugin has been updated to use the `OS` field. 


Suggested change

alpha feature and it graduated to stable in 1.25.`PodSecurity` admission plugin has been updated to use the `OS` field.

alpha feature and it graduated to stable in 1.25. In addition, the `PodSecurity` admission plugin has been updated to use the `OS` field.

Or something like that

Mabye a link to the admission plugin?

The field is os. In the Golang code the capitalization is different, but to a Kubernetes end user the field name is all-lowercase.

jsturtevant · 2022-08-12T15:45:49Z

content/en/blog/_posts/2022-07-27-pod-os-field/index.md

+
+## What problems does this solve?
+
+Today, the `kube-apiserver` and `kubelet` while admitting pods have no notion of the OS on which the pod can run. 


Suggested change

Today, the `kube-apiserver` and `kubelet` while admitting pods have no notion of the OS on which the pod can run.

Today, at pod admission time the `kube-apiserver` and `kubelet` have no notion of the OS on which the pod can run.

Suggested change

Today, the `kube-apiserver` and `kubelet` while admitting pods have no notion of the OS on which the pod can run.

In the first releases of Kubernetes the `kube-apiserver` did not have record any detail

about which operating system a Pod should run on. Initially, Kubernetes only supported Linux

nodes; later, Kubernetes added support for Windows nodes (stable since Kubernetes v1.14).

You could use [labels](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/)

to give the scheduler a hint about where to place your Pod, but the actual Pod API didn't track that

OS at all.

sftim

Some early feedback.

/hold
as valid a publication date isn't assigned yet

sftim · 2022-08-14T16:47:26Z

content/en/blog/_posts/2022-07-27-pod-os-field/index.md

@@ -0,0 +1,50 @@
+# Identify Pod Operating System authoritatively during pod admission time


Suggested change

# Identify Pod Operating System authoritatively during pod admission time

sftim · 2022-08-14T16:47:49Z

content/en/blog/_posts/2022-07-27-pod-os-field/index.md

+layout: blog
+title: "Identifying pod operating system authoritatively during pod admission time"
+date: 2022-07-27
+slug: Identifying pod operating system authoritatively during pod admission time


Suggested change

slug: Identifying pod operating system authoritatively during pod admission time

slug: pod-os-field-explained

sftim · 2022-08-14T16:48:41Z

content/en/blog/_posts/2022-07-27-pod-os-field/index.md

+
+**Authors:** Ravi Gudimetla (Apple)
+
+This blog describes how to identify pod's operating system authoritatively using the `OS` field in the pod spec and how it 


Suggested change

This blog describes how to identify pod's operating system authoritatively using the `OS` field in the pod spec and how it

This article describes how to identify pod's operating system authoritatively using the `os` field in the pod spec, and how that

sftim · 2022-08-14T16:52:05Z

content/en/blog/_posts/2022-07-27-pod-os-field/index.md

+
+## What problems does this solve?
+
+Today, the `kube-apiserver` and `kubelet` while admitting pods have no notion of the OS on which the pod can run. 


Suggested change

Today, the `kube-apiserver` and `kubelet` while admitting pods have no notion of the OS on which the pod can run.

In the first releases of Kubernetes the `kube-apiserver` did not have record any detail

about which operating system a Pod should run on. Initially, Kubernetes only supported Linux

nodes; later, Kubernetes added support for Windows nodes (stable since Kubernetes v1.14).

You could use [labels](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/)

to give the scheduler a hint about where to place your Pod, but the actual Pod API didn't track that

OS at all.

sftim · 2022-08-14T16:52:23Z

content/en/blog/_posts/2022-07-27-pod-os-field/index.md

+## What problems does this solve?
+
+Today, the `kube-apiserver` and `kubelet` while admitting pods have no notion of the OS on which the pod can run. 
+As a result, the end user of the kubernetes cluster can set Linux specific security constraints onto Windows pods or vice-versa. 


Suggested change

As a result, the end user of the kubernetes cluster can set Linux specific security constraints onto Windows pods or vice-versa.

As a result, the end user of a Kubernetes cluster can specify Linux specific security constraints onto Windows pods, or vice-versa.

sftim · 2022-08-14T16:55:33Z

content/en/blog/_posts/2022-07-27-pod-os-field/index.md

+
+
+## How does it work?
+A new field called `OS` has been added to the pod spec. Every object in kubernetes is validated before it 


Suggested change

A new field called `OS` has been added to the pod spec. Every object in kubernetes is validated before it

Pods now have an optional `.spec.os` field (and this is a stable feature, available in every cluster running

Kubernetes v1.25 or later). Every object in Kubernetes is validated before it

sftim · 2022-08-14T16:56:35Z

content/en/blog/_posts/2022-07-27-pod-os-field/index.md

+gets persisted to etcd during API admission time, including pod object. Using the `OS` field in pod spec,
+we introduced new validation which forbids Linux specific constraints to be set on Windows pods and vice-versa.


Suggested change

gets persisted to etcd during API admission time, including pod object. Using the `OS` field in pod spec,

we introduced new validation which forbids Linux specific constraints to be set on Windows pods and vice-versa.

gets persisted to etcd during API admission time, including pod object. Kubernetes v1.25 also introduced

new validation which forbids you from setting Linux specific constraints on Windows pods and vice-versa.

``

sftim · 2022-08-14T16:57:05Z

content/en/blog/_posts/2022-07-27-pod-os-field/index.md

+- AllowPrivilegeEscalation
+- Capabilities
+- SeccompProfile
+when `pod.Spec.OS.Name` is set to `Windows`


Suggested change

when `pod.Spec.OS.Name` is set to `Windows`

when you set `.spec.os.name` for a Pod to `Windows`.

sftim · 2022-08-14T16:57:26Z

content/en/blog/_posts/2022-07-27-pod-os-field/index.md

+
+
+## How do I use it?
+By setting `pod.Spec.OS.Name=Windows` or `pod.Spec.OS.Name=Linux`


Please consider providing an example manifest for a Pod.

sftim · 2022-08-14T17:00:29Z

content/en/blog/_posts/2022-07-27-pod-os-field/index.md

+KEP: https://github.com/kubernetes/enhancements/issues/2802
+API Changes: https://github.com/kubernetes/kubernetes/pull/104693


Once https://kubernetes.io/docs/concepts/workloads/pods/ mentions the new field (see #35590), please link there.

katcosgrove · 2022-08-19T14:08:05Z

Hi there! Your assigned publication date is September 5. Thank you!

sftim · 2022-08-22T21:50:13Z

@ravisantoshgudimetla it'd be great to get this PR ready for review. Would you like help with that?

reylejano · 2022-08-30T16:26:29Z

content/en/blog/_posts/2022-07-27-pod-os-field/index.md

+---
+layout: blog
+title: "Identifying pod operating system authoritatively during pod admission time"
+date: 2022-07-27


Suggested change

date: 2022-07-27

date: 2022-09-05

Also please rename the file to 2022-09-05-pod-os-field.md

reylejano · 2022-08-30T16:28:53Z

Hi @ravisantoshgudimetla , this blog post is scheduled to be published next week on Sept 5.
Please have this PR at a "ready-state" (remove [WIP] from the title) and take a look at comments and suggestions

sftim · 2022-09-02T16:26:37Z

(if this is ready for review, please edit the PR title or add a comment to make it clear that this work should move forward)

sftim

Thanks. Some feedback that I recommend applying.

content/en/blog/_posts/2022-09-05-pod-os-field/index.md

sftim · 2022-09-04T16:42:59Z

@katcosgrove let's postpone this one a week - does that work?

katcosgrove · 2022-09-05T11:55:24Z

@sftim We can do September 12!

sftim · 2022-09-26T19:37:51Z

@ravisantoshgudimetla we're happy to have a version of this article for the blog, but it has missed the timings for post-release blogs. Even though the timing didn't work out, I'd like to make use of the work that has gone in.

Let's aim for a new date. How about the 19th of October? Does that work.

You need to make two changes: one to the filename, and another to the date in the front matter.
Could you also recommend someone who can review the content for technical accuracy? We need to review this before we publish it, and that review needs to cover the technical side.

reylejano · 2022-10-04T18:02:26Z

content/en/blog/_posts/2022-09-05-pod-os-field/index.md

+---
+layout: blog
+title: "Identifying Pod Operating System Authoritatively During Pod Admission Time"
+date: 2022-09-20


The proposed published date has passed, the filename also needs to be changed

Suggested change

date: 2022-09-20

date: 2022-10-19

reylejano · 2022-10-04T18:07:19Z

Hi @kubernetes/sig-windows-leads, can we get a technical review for this blog
Thank you

marosset · 2022-10-04T22:21:21Z

/sig windows

marosset · 2022-10-04T22:25:18Z

content/en/blog/_posts/2022-09-05-pod-os-field/index.md

+
+In the first releases of Kubernetes the `kube-apiserver` did not record any detail about which operating system a Pod should run on. Initially, Kubernetes only supported Linux
+nodes; later, Kubernetes added support for Windows nodes (stable since Kubernetes v1.14).
+You could use [labels](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/)


Maybe we should just say there are many different ways to give the scheduler a hint?
One of the more common ways is to use a nodeSelector.

I'll reword it to While Kubernetes has multiple ways to hint scheduler about the node on which pod needs to run, a more common way is to use nodeSelector, WDYT?

content/en/blog/_posts/2022-09-05-pod-os-field/index.md

marosset · 2022-10-04T22:32:26Z

One of the big motivating factors of having this pod os field is so that windows pods can still be scheduled with Restricted policies which require things like "containers must drop ALL capabilities".
This is called out https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted

I think it would be good to highlight this in the blog post.

sftim · 2022-12-19T09:33:08Z

@ravisantoshgudimetla would you be willing to to revise this in light of #35439 (comment) ?

tengqm · 2023-01-03T07:18:54Z

@ravisantoshgudimetla Ready to give this another stab?

nitishfy · 2023-01-15T16:49:09Z

@ravisantoshgudimetla Ping!

claudiubelu · 2023-02-09T17:43:04Z

Ping @ravisantoshgudimetla . If you're not available, we can take over this PR and address the necessary changes.

ravisantoshgudimetla · 2023-02-15T12:20:58Z

Hey all, I was out for the past few weeks, I can address the changes and will update this PR this week.

Co-authored-by: Mark Rossetti <[email protected]>

k8s-ci-robot · 2023-02-16T23:06:05Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign onlydole for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

content/en/blog/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

ravisantoshgudimetla · 2023-02-16T23:27:29Z

One of the big motivating factors of having this pod os field is so that windows pods can still be scheduled with Restricted policies which require things like "containers must drop ALL capabilities".
This is called out https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
I think it would be good to highlight this in the blog post.

I have added it here - https://github.com/kubernetes/website/pull/35439/files#diff-f2f020ab42d6a660ddb4835f70a43f8a64f9f50204e7ab49d0f275d76af4345cR31. PTAL

sftim · 2023-02-23T20:29:18Z

@ravisantoshgudimetla how about a new publication date - perhaps the 14th of March 2023? If you would like to aim for that, we can see if we can get reviews to happen on the blog team side.

natalisucks · 2023-03-20T19:01:19Z

Adding another friendly ping here @ravisantoshgudimetla 🙂

@sftim Lets choose a new publication date – perhaps a couple of months or so away from today? That way Ravi has enough time to address feedback and the blog team have enough time in parallel to review.

marosset · 2023-03-23T18:32:26Z

@ravisantoshgudimetla - can you make me a collaborator on your k/webite fork and then I can help push this through?

k8s-triage-robot · 2023-06-21T19:20:21Z

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle stale
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

divya-mohan0209 · 2023-07-13T05:20:35Z

/remove-lifeycycle stale

divya-mohan0209 · 2023-07-13T05:23:33Z

@ravisantoshgudimetla : Please advise if you'd like to continue work on this PR and also, let us know of a realistic target date for publication. Additionally, it'd be great if you could grant collaborator access to @marosset as requested in the above comments. This has been in the works for a year and I'm sure you'd appreciate that we'd like to see this merged sooner rather than later.

divya-mohan0209 · 2023-08-16T23:32:48Z

Hey @ravisantoshgudimetla , thank you for all your hard work on this! However, since there has been no activity on addressing the feedback despite repeated reminders we'll be closing the PR. Please feel free to reopen the PR whenever you have the bandwidth to work together so that we can get this blog published.
/close

k8s-ci-robot · 2023-08-16T23:32:53Z

@divya-mohan0209: Closed this PR.

In response to this:

Hey @ravisantoshgudimetla , thank you for all your hard work on this! However, since there has been no activity on addressing the feedback despite repeated reminders we'll be closing the PR. Please feel free to reopen the PR whenever you have the bandwidth to work together so that we can get this blog published.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. area/blog Issues or PRs related to the Kubernetes Blog subproject labels Jul 27, 2022

k8s-ci-robot requested review from nate-double-u and sftim July 27, 2022 12:59

k8s-ci-robot added language/en Issues or PRs related to English language sig/docs Categorizes an issue or PR as relevant to SIG Docs. labels Jul 27, 2022

k8s-ci-robot changed the title ~~pod os field~~ [WIP] Explain use of pod os field Jul 27, 2022

k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 27, 2022

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Aug 12, 2022

ravisantoshgudimetla force-pushed the podos-blogpost branch from 08f595b to e990b19 Compare August 12, 2022 14:39

jsturtevant reviewed Aug 12, 2022

View reviewed changes

tallclair mentioned this pull request Aug 12, 2022

Blog post about Pod Security admission graduating to stable #35614

Merged

sftim reviewed Aug 14, 2022

View reviewed changes

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 14, 2022

reylejano reviewed Aug 30, 2022

View reviewed changes

ravisantoshgudimetla force-pushed the podos-blogpost branch from e990b19 to 30434e6 Compare September 2, 2022 12:39

pod os field

e67e7c1

ravisantoshgudimetla force-pushed the podos-blogpost branch from 30434e6 to e67e7c1 Compare September 2, 2022 12:42

sftim reviewed Sep 2, 2022

View reviewed changes

reylejano reviewed Oct 4, 2022

View reviewed changes

k8s-ci-robot added the sig/windows Categorizes an issue or PR as relevant to SIG Windows. label Oct 4, 2022

marosset reviewed Oct 4, 2022

View reviewed changes

content/en/blog/_posts/2022-09-05-pod-os-field/index.md Outdated Show resolved Hide resolved

marosset reviewed Oct 4, 2022

View reviewed changes

content/en/blog/_posts/2022-09-05-pod-os-field/index.md Outdated Show resolved Hide resolved

marosset reviewed Oct 4, 2022

View reviewed changes

content/en/blog/_posts/2022-09-05-pod-os-field/index.md Outdated Show resolved Hide resolved

Apply suggestions from code review

581142e

Co-authored-by: Mark Rossetti <[email protected]>

Update publication date

266d6c3

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jun 21, 2023

divya-mohan0209 removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jul 13, 2023

k8s-ci-robot closed this Aug 16, 2023

	alpha feature and it graduated to stable in 1.25.`PodSecurity` admission plugin has been updated to use the `OS` field.
	alpha feature and it graduated to stable in 1.25. In addition, the `PodSecurity` admission plugin has been updated to use the `OS` field.


		## What problems does this solve?

		Today, the `kube-apiserver` and `kubelet` while admitting pods have no notion of the OS on which the pod can run.

	Today, the `kube-apiserver` and `kubelet` while admitting pods have no notion of the OS on which the pod can run.
	Today, at pod admission time the `kube-apiserver` and `kubelet` have no notion of the OS on which the pod can run.

		@@ -0,0 +1,50 @@
		# Identify Pod Operating System authoritatively during pod admission time

	slug: Identifying pod operating system authoritatively during pod admission time
	slug: pod-os-field-explained


		Authors: Ravi Gudimetla (Apple)

		This blog describes how to identify pod's operating system authoritatively using the `OS` field in the pod spec and how it

	This blog describes how to identify pod's operating system authoritatively using the `OS` field in the pod spec and how it
	This article describes how to identify pod's operating system authoritatively using the `os` field in the pod spec, and how that

	As a result, the end user of the kubernetes cluster can set Linux specific security constraints onto Windows pods or vice-versa.
	As a result, the end user of a Kubernetes cluster can specify Linux specific security constraints onto Windows pods, or vice-versa.



		## How does it work?
		A new field called `OS` has been added to the pod spec. Every object in kubernetes is validated before it

	A new field called `OS` has been added to the pod spec. Every object in kubernetes is validated before it
	Pods now have an optional `.spec.os` field (and this is a stable feature, available in every cluster running
	Kubernetes v1.25 or later). Every object in Kubernetes is validated before it

		gets persisted to etcd during API admission time, including pod object. Using the `OS` field in pod spec,
		we introduced new validation which forbids Linux specific constraints to be set on Windows pods and vice-versa.

	when `pod.Spec.OS.Name` is set to `Windows`
	when you set `.spec.os.name` for a Pod to `Windows`.



		## How do I use it?
		By setting `pod.Spec.OS.Name=Windows` or `pod.Spec.OS.Name=Linux`

		KEP: https://github.com/kubernetes/enhancements/issues/2802
		API Changes: https://github.com/kubernetes/kubernetes/pull/104693

Explain use of pod os field #35439

Explain use of pod os field #35439

Conversation

ravisantoshgudimetla commented Jul 27, 2022

netlify bot commented Jul 27, 2022 • edited Loading

✅ Pull request preview available for checking

sftim commented Jul 27, 2022

katcosgrove commented Aug 12, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sftim left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

katcosgrove commented Aug 19, 2022

sftim commented Aug 22, 2022

Choose a reason for hiding this comment

reylejano commented Aug 30, 2022

sftim commented Sep 2, 2022

sftim left a comment

Choose a reason for hiding this comment

sftim commented Sep 4, 2022

katcosgrove commented Sep 5, 2022

sftim commented Sep 26, 2022

reylejano Oct 4, 2022 • edited Loading

Choose a reason for hiding this comment

reylejano commented Oct 4, 2022

marosset commented Oct 4, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

marosset commented Oct 4, 2022

sftim commented Dec 19, 2022

tengqm commented Jan 3, 2023

nitishfy commented Jan 15, 2023

claudiubelu commented Feb 9, 2023

ravisantoshgudimetla commented Feb 15, 2023 • edited Loading

k8s-ci-robot commented Feb 16, 2023

ravisantoshgudimetla commented Feb 16, 2023

sftim commented Feb 23, 2023

natalisucks commented Mar 20, 2023

marosset commented Mar 23, 2023

k8s-triage-robot commented Jun 21, 2023

divya-mohan0209 commented Jul 13, 2023

divya-mohan0209 commented Jul 13, 2023

divya-mohan0209 commented Aug 16, 2023

k8s-ci-robot commented Aug 16, 2023

netlify bot commented Jul 27, 2022 •

edited

Loading

reylejano Oct 4, 2022 •

edited

Loading

ravisantoshgudimetla commented Feb 15, 2023 •

edited

Loading