Calico Windows HostProcess manifests break with containerd 1.7.0-beta.3 (see related)

[doctorpangloss]

After upgrading from containerd 1.6.8 to 1.7.0-beta.3 on Windows 2022, the Calico Windows HostProcess based manifest broke with an inability to find paths to files.

This can be resolved with a different approach to specifying paths in the manifests.

See containerd/containerd#8090

Expected Behavior

Manifests authored for containerd 1.6.8 should keep working under 1.7.0-beta.3.

Current Behavior

They do not.

Possible Solution

diff --git a/apps/base/calico-windows-3.23.5.yaml b/apps/base/calico-windows-3.23.5.yaml
index 6060456..1f0fdbc 100644
--- a/apps/base/calico-windows-3.23.5.yaml
+++ b/apps/base/calico-windows-3.23.5.yaml
@@ -41,6 +41,7 @@ spec:
           envFrom:
             - configMapRef:
                 name: calico-windows-config
+          workingDir: "$env:CONTAINER_SANDBOX_MOUNT_POINT"
           # Calico needs to know the name of the node on which it is running.
           env:
             - name: NODENAME
@@ -53,10 +54,10 @@ spec:
           image: calico/windows:v3.23.5
           imagePullPolicy: Always
           args:
-            - ".\\node\\node-service.ps1"
+            - "C:/CalicoWindows/node/node-service.ps1"
           # The node container's working dir is in c:\CalicoWindows on the host,
           # which is two-levels up from the CONTAINER_SANDBOX_MOUNT_POINT.
-          workingDir: "..\\..\\CalicoWindows"
+          workingDir: "C:/CalicoWindows"
           envFrom:
             - configMapRef:
                 name: calico-windows-config
@@ -71,10 +72,10 @@ spec:
           image: calico/windows:v3.23.5
           imagePullPolicy: Always
           args:
-            - ".\\felix\\felix-service.ps1"
+            - "C:/CalicoWindows/felix/felix-service.ps1"
           # The felix container's working dir is in c:\CalicoWindows on the host,
           # which is two-levels up from the CONTAINER_SANDBOX_MOUNT_POINT.
-          workingDir: "..\\..\\CalicoWindows"
+          workingDir: "C:/CalicoWindows"
           envFrom:
             - configMapRef:
                 name: calico-windows-config
@@ -105,10 +106,10 @@ spec:
           image: calico/windows:v3.23.5
           imagePullPolicy: Always
           args:
-            - ".\\confd\\confd-service.ps1"
+            - "C:/CalicoWindows/confd/confd-service.ps1"
           # The confd container's working dir is in c:\CalicoWindows on the host,
           # which is two-levels up from the CONTAINER_SANDBOX_MOUNT_POINT.
-          workingDir: "..\\..\\CalicoWindows"
+          workingDir: "C:/CalicoWindows"
           envFrom:
             - configMapRef:
                 name: calico-windows-config

Steps to Reproduce (for bugs)

See containerd/containerd#8090

Context

Users upgrading containerd will encounter bugs with the current manifests. My suggested solution may work for all users.

Your Environment

• Calico version: 3.23.5
• Orchestrator version: kubernetes 1.26.0
• Operating System and version: Windows 2022 LTSC

[doctorpangloss]

It looks like Calico will have to address changes from https://github.com/kubernetes/enhancements/tree/master/keps/sig-windows/1981-windows-privileged-container-support#container-mounts

[coutinhop]

This will be fixed by #7857 and tigera/operator#2732, but not exactly the manifests. The install using operator will support both containerd v1.6 and v1.7.

[coutinhop]

Closing this as fixed by #7857 and tigera/operator#2732