AKS 中 Windows Server 节点池的常见问题Frequently asked questions for Windows Server node pools in AKS

在 Azure Kubernetes 服务 (AKS) 中,可以创建在节点上将 Windows Server 作为来宾 OS 运行的节点池。In Azure Kubernetes Service (AKS), you can create a node pool that runs Windows Server as the guest OS on the nodes. 这些节点可以运行本机 Windows 容器应用程序,例如基于 .NET Framework 生成的应用程序。These nodes can run native Windows container applications, such as those built on the .NET Framework. Linux 和 Windows 操作系统提供容器支持的方式存在差异。There are differences in how the Linux and Windows OS provides container support. 有些常见的 Linux Kubernetes 和 Pod 相关的功能目前无法用于 Windows 节点池。Some common Linux Kubernetes and pod-related features are not currently available for Windows node pools.

本文概述了 AKS 中 Windows Server 节点的一些常见问题和操作系统概念。This article outlines some of the frequently asked questions and OS concepts for Windows Server nodes in AKS.

支持哪些 Windows 操作系统?Which Windows operating systems are supported?

AKS 使用 Windows Server 2019 作为主机 OS 版本,并且仅支持进程隔离。AKS uses Windows Server 2019 as the host OS version and only supports process isolation. 不支持使用其他 Windows Server 版本生成的容器映像。Container images built using other Windows Server versions are not supported. 有关详细信息,请参阅 Windows 容器版本兼容性For more information, see Windows container version compatibility.

Kubernetes 在 Windows 和 Linux 上是否有所不同?Is Kubernetes different on Windows and Linux?

Windows Server 节点池支持具有一些限制,Kubernetes 项目中的上游 Windows Server 也具有这些限制。Window Server node pool support includes some limitations that are part of the upstream Windows Server in Kubernetes project. 这些限制并不特定于 AKS。These limitations are not specific to AKS. 有关 Kubernetes 中的 Windows Server 上游支持的详细信息,请参阅 Kubernetes 项目的 Kubernetes 中的 Windows 支持简介文档的支持的功能和限制部分。For more information on this upstream support for Windows Server in Kubernetes, see the Supported Functionality and Limitations section of the Intro to Windows support in Kubernetes document, from the Kubernetes project.

Kubernetes 历来以 Linux 为中心。Kubernetes is historically Linux-focused. 上游 Kubernetes.io 网站中使用的许多示例旨在用于 Linux 节点。Many examples used in the upstream Kubernetes.io website are intended for use on Linux nodes. 创建使用 Windows Server 容器的部署时,OS 级别的以下注意事项适用:When you create deployments that use Windows Server containers, the following considerations at the OS-level apply:

  • 标识 - Linux 通过整数用户标识符 (UID) 标识用户。Identity - Linux identifies a user by an integer user identifier (UID). 用户还具有用于登录的字母数字用户名,Linux 会将其转换为用户的 UID。A user also has an alphanumeric user name for logging on, which Linux translates to the user's UID. 同样,Linux 通过整数组标识符 (GID) 标识用户组,并将组名转换为其相应的 GID。Similarly Linux identifies a user group by an integer group identifier (GID) and translates a group name to its corresponding GID.
    • Windows Server 使用更大的二进制安全标识符 (SID),该标识符存储在 Windows Security Access Manager (SAM) 数据库中。Windows Server uses a larger binary security identifier (SID) which is stored in the Windows Security Access Manager (SAM) database. 此数据库不在主机与容器之间或容器之间共享。This database is not shared between the host and containers, or between containers.
  • 文件权限 - Windows Server 使用基于 SID 的访问控制列表,而不是权限和 UID + GID 的位掩码File permissions - Windows Server uses an access control list based on SIDs, rather than a bitmask of permissions and UID+GID
  • 文件路径 - Windows Server 上的约定是使用 \,而不是 /。File paths - convention on Windows Server is to use \ instead of /.
    • 在装载卷的 Pod 规范中,为 Windows Server 容器正确指定路径。In pod specs that mount volumes, specify the path correctly for Windows Server containers. 例如,不要在 Linux 容器中指定装入点 /mnt/volume,而是将要装载的驱动器号和位置(例如 /K/Volume )指定为 K: 驱动器。For example, rather than a mount point of /mnt/volume in a Linux container, specify a drive letter and location such as /K/Volume to mount as the K: drive.

Windows 支持哪种磁盘?What kind of disks are supported for Windows?

Azure 磁盘和 Azure 文件存储是受支持的卷类型。Azure Disks and Azure Files are the supported volume types. 它们在 Windows Server 容器中是作为 NTFS 卷访问的。These are accessed as NTFS volumes in the Windows Server container.

是否可以在 AKS 中运行仅限 Windows 的群集?Can I run Windows only clusters in AKS?

AKS 群集中的主节点(控制平面)由 AKS 服务托管,不会向你公开托管主组件的节点的操作系统。The master nodes (the control plane) in an AKS cluster are hosted by AKS the service, you will not be exposed to the operating system of the nodes hosting the master components. 所有的 AKS 群集在创建时都带有默认的第一个节点池(基于 Linux)。All AKS clusters are created with a default first node pool, which is Linux-based. 此节点池包含系统服务,群集需要这些服务才能运行函数。This node pool contains system services, which are needed for the cluster to function. 建议在第一个节点池中至少运行两个节点,以确保群集的可靠性和执行群集操作的能力。It's recommended to run at least two nodes in the first node pool to ensure reliability of your cluster and the ability to do cluster operations. 除非删除 AKS 群集本身,否则无法删除第一个基于 Linux 的节点池。The first Linux-based node pool can't be deleted unless the AKS cluster itself is deleted.

如何修补 Windows 节点?How do I patch my Windows nodes?

若要获取用于 Windows 节点的最新补丁,可以升级节点池升级节点映像To get the latest patches for Windows nodes, you can either upgrade the node pool or upgrade the node image. AKS 中的节点上未启用 Windows 更新。Windows Updates are not enabled on nodes in AKS. 一有补丁可用,AKS 就会发布新节点池映像,用户自己负责升级节点池来保持使用最新的补丁和修补程序。AKS releases new node pool images as soon as patches are available, and it's the user's responsibility to upgrade node pools to stay current on patches and hotfixes. 对于所使用的 Kubernetes 版本也是如此。This is also true for the Kubernetes version being used. AKS 发行说明将指示何时有新版本可用。AKS release notes indicate when new versions are available. 若要详细了解如何升级整个 Windows Server 节点池,请参阅升级 AKS 中的节点池For more information on upgrading the entire Windows Server node pool, see Upgrade a node pool in AKS. 如果只需要更新节点映像,请参阅 AKS 节点映像升级If you're only interested in updating the node image, see AKS node image upgrades.

备注

只有在升级节点池之前已经执行了群集升级(控制平面升级)的情况下,才会使用更新的 Windows Server 映像。The updated Windows Server image will only be used if a cluster upgrade (control plane upgrade) has been performed prior to upgrading the node pool.

支持哪些网络插件?What network plug-ins are supported?

具有 Windows 节点池的 AKS 群集必须使用 Azure CNI(高级)网络模型。AKS clusters with Windows node pools must use the Azure CNI (advanced) networking model. 不支持 Kubenet(基本)网络。Kubenet (basic) networking is not supported. 有关网络模型差异的详细信息,请参阅适用于 AKS 中的应用程序的网络概念For more information on the differences in network models, see Network concepts for applications in AKS. Azure CNI 网络模型需要对 IP 地址管理进行其他规划和考量。The Azure CNI network model requires additional planning and considerations for IP address management. 有关如何规划和实现 Azure CNI 的详细信息,请参阅在 AKS 中配置 Azure CNI 网络For more information on how to plan and implement Azure CNI, see Configure Azure CNI networking in AKS.

是否支持保留客户端源 IP?Is preserving the client source IP supported?

目前,Windows 节点不支持客户端源 IP 保留At this time, client source IP preservation is not supported with Windows nodes.

是否可以更改每个节点的最大 Pod 数量?Can I change the max. # of pods per node?

是的。Yes. 有关影响和可用选项,请参阅最大 Pod 数For the implications and options that are available, see Maximum number of pods.

尝试创建新的 Windows 代理池时,为什么会发生错误?Why am I seeing an error when I try to create a new Windows agent pool?

如果群集是在 2020 年 2 月之前创建的,且从未执行过任何群集升级操作,该群集仍将使用旧的 Windows 映像。If you created your cluster before February 2020 and have never done any cluster upgrade operations, the cluster still uses an old Windows image. 你可能会看到类似于以下内容的错误:You may have seen an error that resembles:

“找不到从部署模板中引用的下列映像:发布者:MicrosoftWindowsServer,产品/服务:WindowsServer, Sku:2019-datacenter-core-smalldisk-2004,版本:最新版本。"The following list of images referenced from the deployment template is not found: Publisher: MicrosoftWindowsServer, Offer: WindowsServer, Sku: 2019-datacenter-core-smalldisk-2004, Version: latest. 有关如何查找可用映像的说明,请参阅 https://docs.azure.cn/virtual-machines/windows/cli-ps-findimage 。”Please refer to https://docs.azure.cn/virtual-machines/windows/cli-ps-findimage for instructions on finding available images."

修复此错误的方法:To fix this error:

  1. 升级群集控制平面以更新映像产品/服务和发布者。Upgrade the cluster control plane to update the image offer and publisher.
  2. 创建新的 Windows 代理池。Create new Windows agent pools.
  3. 将 Windows Pod 从现有 Windows 代理池移动到新的 Windows 代理池。Move Windows pods from existing Windows agent pools to new Windows agent pools.
  4. 删除旧的 Windows 代理池。Delete old Windows agent pools.

如何轮换 Windows 节点池的服务主体?How do I rotate the service principal for my Windows node pool?

Windows 节点池不支持服务主体轮换。Windows node pools do not support service principal rotation. 若要更新服务主体,请创建新的 Windows 节点池,并将 Pod 从旧池迁移到新池。To update the service principal, create a new Windows node pool and migrate your pods from the older pool to the new one. 完成此操作后,删除旧节点池。Once this is complete, delete the older node pool.

请改为使用托管标识,它们本质上是服务主体的包装器。Instead, use managed identities, which are essentially wrappers around service principals. 有关详细信息,请参阅在 Azure Kubernetes 服务中使用托管标识For more information, see Use managed identities in Azure Kubernetes Service.

我可以创建多少个节点池?How many node pools can I create?

AKS 群集最多可以包含 10 个节点池。The AKS cluster can have a maximum of 10 node pools. 这些节点池中最多可以有 1000 个节点。You can have a maximum of 1000 nodes across those node pools. 节点池限制Node pool limitations.

我可以如何为 Windows 节点池命名?What can I name my Windows node pools?

必须将名称保持在最多 6(六)个字符。You have to keep the name to a maximum of 6 (six) characters. 这是 AKS 的当前限制。This is a current limitation of AKS.

Windows 节点是否支持所有功能?Are all features supported with Windows nodes?

Windows 节点当前不支持网络策略和 Kubenet。Network policies and kubenet are currently not supported with Windows nodes.

我是否可以在 Windows 节点上运行入口控制器?Can I run ingress controllers on Windows nodes?

是,支持 Windows Server 容器的入口控制器可以在 AKS 中的 Windows 节点上运行。Yes, an ingress-controller that supports Windows Server containers can run on Windows nodes in AKS.

我是否可以将 Azure Dev Spaces 与 Windows 节点配合使用?Can I use Azure Dev Spaces with Windows nodes?

Azure Dev Spaces 当前仅可用于基于 Linux 的节点池。Azure Dev Spaces is currently only available for Linux-based node pools.

我的 Windows Server 容器是否可以使用 gMSA?Can my Windows Server containers use gMSA?

AKS 当前不提供组托管服务帐户 (gMSA) 支持。Group managed service accounts (gMSA) support is not currently available in AKS.

是否可以将 Azure Monitor 用于包含 Windows 节点和容器的容器?Can I use Azure Monitor for containers with Windows nodes and containers?

可以,但 Azure Monitor 现为公共预览版,用于从 Windows 容器收集日志(stdout,stderr)和指标。Yes you can, however Azure Monitor is in public preview for gathering logs (stdout, stderr) and metrics from Windows containers. 你仍可从 Windows 容器附加到 stdout 日志的实时传送流。You can also attach to the live stream of stdout logs from a Windows container.

在具有 Windows 节点的群集上,服务的数量是否有限制?Are there any limitations on the number of services on a cluster with Windows nodes?

具有 Windows 节点的群集可以有大约 500 个服务,超过它就会导致端口耗尽。A cluster with Windows nodes can have approximately 500 services before it encounters port exhaustion.

是否可以将 Kubernetes Web 仪表板用于 Windows 容器?Can I use the Kubernetes Web Dashboard with Windows containers?

是的,你可以使用 Kubernetes Web 仪表板来访问有关 Windows 容器的信息,但目前不能直接从 Kubernetes Web 仪表板将 kubectl exec 运行到正在运行的 Windows 容器中。Yes, you can use the Kubernetes Web Dashboard to access information about Windows containers, but at this time you can't run kubectl exec into a running Windows container directly from the Kubernetes Web Dashboard. 若要详细了解如何连接到正在运行的 Windows 容器,请参阅使用 RDP 连接到 Azure Kubernetes 服务 (AKS) 群集 Windows Server 节点以进行维护或故障排除For more details on connecting to your running Windows container, see Connect with RDP to Azure Kubernetes Service (AKS) cluster Windows Server nodes for maintenance or troubleshooting.

如果需要使用不受支持的功能,应该怎么办?What if I need a feature that's not supported?

我们致力于在 AKS 中引入你需要的所有 Windows 功能,但如果确实遇到功能差距,开源的上游 aks-engine 项目提供了在 Azure 中运行 Kubernetes 的完全可自定义的简便方法,其中包括 Windows 支持。We work hard to bring all the features you need to Windows in AKS, but if you do encounter gaps, the open-source, upstream aks-engine project provides an easy and fully customizable way of running Kubernetes in Azure, including Windows support. 请确保查看即将推出的 AKS 路线图中的功能路线图。Be sure to check out our roadmap of features coming AKS roadmap.

后续步骤Next steps

若要开始在 AKS 中使用 Windows Server 容器,请创建一个在 AKS 中运行 Windows Server 的节点池To get started with Windows Server containers in AKS, create a node pool that runs Windows Server in AKS.