From b8883b84db2b9c34755e1f8c4d0dd76b5fdf84a7 Mon Sep 17 00:00:00 2001 From: Daniel Shebib Date: Wed, 28 Dec 2022 20:02:50 -0600 Subject: [PATCH 1/4] Update privileged pod documentation to reflect GA feature --- content/en/docs/concepts/workloads/pods/_index.md | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/content/en/docs/concepts/workloads/pods/_index.md b/content/en/docs/concepts/workloads/pods/_index.md index 76c966757a3..0f4fad4ded0 100644 --- a/content/en/docs/concepts/workloads/pods/_index.md +++ b/content/en/docs/concepts/workloads/pods/_index.md @@ -289,9 +289,18 @@ section. ## Privileged mode for containers -In Linux, any container in a Pod can enable privileged mode using the `privileged` (Linux) flag on the [security context](/docs/tasks/configure-pod-container/security-context/) of the container spec. This is useful for containers that want to use operating system administrative capabilities such as manipulating the network stack or accessing hardware devices. +{{< feature-state for_k8s_version="v1.26" state="stable" >}} -If your cluster has the `WindowsHostProcessContainers` feature enabled, you can create a [Windows HostProcess pod](/docs/tasks/configure-pod-container/create-hostprocess-pod) by setting the `windowsOptions.hostProcess` flag on the security context of the pod spec. All containers in these pods must run as Windows HostProcess containers. HostProcess pods run directly on the host and can also be used to perform administrative tasks as is done with Linux privileged containers. +In Linux, any container in a Pod can enable privileged mode using the `privileged` (Linux) flag +on the [security context](/docs/tasks/configure-pod-container/security-context/) of the +container spec. This is useful for containers that want to use operating system administrative +capabilities such as manipulating the network stack or accessing hardware devices. + +In Windows, you can create a [Windows HostProcess pod](/docs/tasks/configure-pod-container/create-hostprocess-pod) +by setting the `windowsOptions.hostProcess` flag on the security context of the pod spec. All containers in these +pods must run as Windows HostProcess containers. HostProcess pods run directly on the host and can also be used +to perform administrative tasks as is done with Linux privileged containers. In order to use this feature, the +`WindowsHostProcessContainers`[feature gate](/docs/reference/command-line-tools-reference/feature-gates/) must be enabled. {{< note >}} Your {{< glossary_tooltip text="container runtime" term_id="container-runtime" >}} must support the concept of a privileged container for this setting to be relevant. From 87537d3b5b1e92d6e5ce0c2b65abb8a0477222f6 Mon Sep 17 00:00:00 2001 From: Daniel Shebib Date: Thu, 12 Jan 2023 18:52:21 -0600 Subject: [PATCH 2/4] document privileged containers as GC --- content/en/docs/concepts/workloads/pods/_index.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/content/en/docs/concepts/workloads/pods/_index.md b/content/en/docs/concepts/workloads/pods/_index.md index 0f4fad4ded0..21f339cca5e 100644 --- a/content/en/docs/concepts/workloads/pods/_index.md +++ b/content/en/docs/concepts/workloads/pods/_index.md @@ -289,13 +289,20 @@ section. ## Privileged mode for containers -{{< feature-state for_k8s_version="v1.26" state="stable" >}} +Any container in a pod can run in privileged mode to use operating system administrative capabilities +that would otherwise be inaccessible. This is available for both Windows and Linux. + +### Linux containers In Linux, any container in a Pod can enable privileged mode using the `privileged` (Linux) flag on the [security context](/docs/tasks/configure-pod-container/security-context/) of the container spec. This is useful for containers that want to use operating system administrative capabilities such as manipulating the network stack or accessing hardware devices. +### Windows containers + +{{< feature-state for_k8s_version="v1.26" state="stable" >}} + In Windows, you can create a [Windows HostProcess pod](/docs/tasks/configure-pod-container/create-hostprocess-pod) by setting the `windowsOptions.hostProcess` flag on the security context of the pod spec. All containers in these pods must run as Windows HostProcess containers. HostProcess pods run directly on the host and can also be used From bc12666f6896b95ddabcad4ec0160fe3cd987bb8 Mon Sep 17 00:00:00 2001 From: Daniel Shebib Date: Thu, 12 Jan 2023 19:09:14 -0600 Subject: [PATCH 3/4] document privileged containers as GC --- content/en/docs/concepts/workloads/pods/_index.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/content/en/docs/concepts/workloads/pods/_index.md b/content/en/docs/concepts/workloads/pods/_index.md index 21f339cca5e..93818c3dcd1 100644 --- a/content/en/docs/concepts/workloads/pods/_index.md +++ b/content/en/docs/concepts/workloads/pods/_index.md @@ -289,7 +289,11 @@ section. ## Privileged mode for containers -Any container in a pod can run in privileged mode to use operating system administrative capabilities +{{< note >}} +Your {{< glossary_tooltip text="container runtime" term_id="container-runtime" >}} must support the concept of a privileged container for this setting to be relevant. +{{< /note >}} + +Any container in a pod can run in priveleged mode to use operating system administrative capabilities that would otherwise be inaccessible. This is available for both Windows and Linux. ### Linux containers @@ -309,9 +313,6 @@ pods must run as Windows HostProcess containers. HostProcess pods run directly o to perform administrative tasks as is done with Linux privileged containers. In order to use this feature, the `WindowsHostProcessContainers`[feature gate](/docs/reference/command-line-tools-reference/feature-gates/) must be enabled. -{{< note >}} -Your {{< glossary_tooltip text="container runtime" term_id="container-runtime" >}} must support the concept of a privileged container for this setting to be relevant. -{{< /note >}} ## Static Pods From ba37aa6ba7464a35a8f31697fdd91f46b7ca2225 Mon Sep 17 00:00:00 2001 From: Daniel Shebib Date: Thu, 12 Jan 2023 19:09:46 -0600 Subject: [PATCH 4/4] document privileged containers as GC --- content/en/docs/concepts/workloads/pods/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/workloads/pods/_index.md b/content/en/docs/concepts/workloads/pods/_index.md index 93818c3dcd1..874e85523f8 100644 --- a/content/en/docs/concepts/workloads/pods/_index.md +++ b/content/en/docs/concepts/workloads/pods/_index.md @@ -293,7 +293,7 @@ section. Your {{< glossary_tooltip text="container runtime" term_id="container-runtime" >}} must support the concept of a privileged container for this setting to be relevant. {{< /note >}} -Any container in a pod can run in priveleged mode to use operating system administrative capabilities +Any container in a pod can run in privileged mode to use operating system administrative capabilities that would otherwise be inaccessible. This is available for both Windows and Linux. ### Linux containers