Merge pull request #63905 from feiskyer/win-dns

Automatic merge from submit-queue (batch tested with PRs 63905, 64855). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Setup dns servers and search domains for Windows Pods

**What this PR does / why we need it**:

Kubelet is depending on docker container's ResolvConfPath (e.g. /var/lib/docker/containers/439efe31d70fc17485fb6810730679404bb5a6d721b10035c3784157966c7e17/resolv.conf) to setup dns servers and search domains. While this is ok for Linux containers, ResolvConfPath is always an empty string for windows containers. So that the DNS setting for windows containers is always not set.

This PR setups DNS for Windows sandboxes. In this way, Windows Pods could also use kubernetes dns policies.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #61579

**Special notes for your reviewer**:

Requires Docker EE version >= 17.10.0.

**Release note**:

```release-note
Setup dns servers and search domains for Windows Pods in dockershim. Docker EE version >= 17.10.0 is required for propagating DNS to containers.
```

/cc @PatrickLang @taylorb-microsoft @michmike @JiangtianLi

pkg/kubelet/dockershim/BUILD

@@ -21,56 +21,67 @@ go_library(
     ] + select({
         "@io_bazel_rules_go//go/platform:android": [
             "docker_image_unsupported.go",
+            "docker_sandbox_others.go",
             "docker_stats_unsupported.go",
             "helpers_unsupported.go",
         ],
         "@io_bazel_rules_go//go/platform:darwin": [
             "docker_image_unsupported.go",
+            "docker_sandbox_others.go",
             "docker_stats_unsupported.go",
             "helpers_unsupported.go",
         ],
         "@io_bazel_rules_go//go/platform:dragonfly": [
             "docker_image_unsupported.go",
+            "docker_sandbox_others.go",
             "docker_stats_unsupported.go",
             "helpers_unsupported.go",
         ],
         "@io_bazel_rules_go//go/platform:freebsd": [
             "docker_image_unsupported.go",
+            "docker_sandbox_others.go",
             "docker_stats_unsupported.go",
             "helpers_unsupported.go",
         ],
         "@io_bazel_rules_go//go/platform:linux": [
             "docker_image_linux.go",
+            "docker_sandbox_others.go",
             "docker_stats_linux.go",
             "helpers_linux.go",
         ],
         "@io_bazel_rules_go//go/platform:nacl": [
             "docker_image_unsupported.go",
+            "docker_sandbox_others.go",
             "docker_stats_unsupported.go",
             "helpers_unsupported.go",
         ],
         "@io_bazel_rules_go//go/platform:netbsd": [
             "docker_image_unsupported.go",
+            "docker_sandbox_others.go",
             "docker_stats_unsupported.go",
             "helpers_unsupported.go",
         ],
         "@io_bazel_rules_go//go/platform:openbsd": [
             "docker_image_unsupported.go",
+            "docker_sandbox_others.go",
             "docker_stats_unsupported.go",
             "helpers_unsupported.go",
         ],
         "@io_bazel_rules_go//go/platform:plan9": [
             "docker_image_unsupported.go",
+            "docker_sandbox_others.go",
             "docker_stats_unsupported.go",
             "helpers_unsupported.go",
         ],
         "@io_bazel_rules_go//go/platform:solaris": [
             "docker_image_unsupported.go",
+            "docker_sandbox_others.go",
             "docker_stats_unsupported.go",
             "helpers_unsupported.go",
         ],
         "@io_bazel_rules_go//go/platform:windows": [
             "docker_image_windows.go",
+            "docker_sandbox_windows.go",
             "docker_stats_windows.go",
             "helpers_windows.go",
         ],

pkg/kubelet/dockershim/docker_sandbox.go

@@ -539,21 +539,6 @@ func (ds *dockerService) ListPodSandbox(_ context.Context, r *runtimeapi.ListPod
 	return &runtimeapi.ListPodSandboxResponse{Items: result}, nil
 }
 
-// applySandboxLinuxOptions applies LinuxPodSandboxConfig to dockercontainer.HostConfig and dockercontainer.ContainerCreateConfig.
-func (ds *dockerService) applySandboxLinuxOptions(hc *dockercontainer.HostConfig, lc *runtimeapi.LinuxPodSandboxConfig, createConfig *dockertypes.ContainerCreateConfig, image string, separator rune) error {
-	if lc == nil {
-		return nil
-	}
-	// Apply security context.
-	if err := applySandboxSecurityContext(lc, createConfig.Config, hc, ds.network, separator); err != nil {
-		return err
-	}
-
-	// Set sysctls.
-	hc.Sysctls = lc.Sysctls
-	return nil
-}
-
 func (ds *dockerService) applySandboxResources(hc *dockercontainer.HostConfig, lc *runtimeapi.LinuxPodSandboxConfig) error {
 	hc.Resources = dockercontainer.Resources{
 		MemorySwap: DefaultMemorySwap(),
@@ -594,8 +579,8 @@ func (ds *dockerService) makeSandboxDockerConfig(c *runtimeapi.PodSandboxConfig,
 		HostConfig: hc,
 	}
 
-	// Apply linux-specific options.
-	if err := ds.applySandboxLinuxOptions(hc, c.GetLinux(), createConfig, image, securityOptSeparator); err != nil {
+	// Apply platform-specific options.
+	if err := ds.applySandboxPlatformOptions(hc, c, createConfig, image, securityOptSeparator); err != nil {
 		return nil, err
 	}
 

pkg/kubelet/dockershim/docker_sandbox_others.go

@@ -0,0 +1,42 @@
+// +build !windows
+
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package dockershim
+
+import (
+	dockertypes "github.com/docker/docker/api/types"
+	dockercontainer "github.com/docker/docker/api/types/container"
+	runtimeapi "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
+)
+
+// applySandboxPlatformOptions applies platform specific options to dockercontainer.HostConfig and dockercontainer.ContainerCreateConfig.
+func (ds *dockerService) applySandboxPlatformOptions(hc *dockercontainer.HostConfig, config *runtimeapi.PodSandboxConfig, createConfig *dockertypes.ContainerCreateConfig, image string, separator rune) error {
+	lc := config.GetLinux()
+	if lc == nil {
+		return nil
+	}
+
+	// Apply security context.
+	if err := applySandboxSecurityContext(lc, createConfig.Config, hc, ds.network, separator); err != nil {
+		return err
+	}
+
+	// Set sysctls.
+	hc.Sysctls = lc.Sysctls
+	return nil
+}

pkg/kubelet/dockershim/docker_sandbox_windows.go

@@ -0,0 +1,39 @@
+// +build windows
+
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package dockershim
+
+import (
+	dockertypes "github.com/docker/docker/api/types"
+	dockercontainer "github.com/docker/docker/api/types/container"
+	runtimeapi "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
+)
+
+// applySandboxPlatformOptions applies platform specific options to dockercontainer.HostConfig and dockercontainer.ContainerCreateConfig.
+func (ds *dockerService) applySandboxPlatformOptions(hc *dockercontainer.HostConfig, config *runtimeapi.PodSandboxConfig, createConfig *dockertypes.ContainerCreateConfig, image string, separator rune) error {
+	dnsConfig := config.GetDnsConfig()
+	if dnsConfig == nil {
+		return nil
+	}
+
+	// Setup DNS.
+	hc.DNS = dnsConfig.GetServers()
+	hc.DNSSearch = dnsConfig.GetSearches()
+	hc.DNSOptions = dnsConfig.GetOptions()
+	return nil
+}