Move "docker-healthcheck" to DockerBuilder

[hakman]

The Docker health check should be running only when the container runtime is Docker. At the moment it is also triggered for containerd.

This change moves the docker-healthcheck script, service and timer to DockerBuilder.

Based on Office Hours discussion, the health check will be enabled through a new config option:

spec:
  docker:
    healthCheck: true

[k8s-ci-robot]

Hi @hakman. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[rifelpet]

/ok-to-test

[hakman]

/assign @justinsb

[johngmyers]

/test pull-kops-e2e-kubernetes-aws

[hakman]

@justinsb did you get a chance ask around if this is still needed or if there is a better place for it in the Kops code?

[justinsb]

The guidance I got was that much of the functionality has moved to Node Problem Detector and we likely don't need the healthcheck itself any more. So I propose we get this in so we stop using it at least for containerd, , and maybe also add NPD support.

Given release timings I'm not sure if / how far we want to backport this. Probably not 1.16, maybe 1.17 (but maybe not).

We then have a choice: we can either actively stop using the healthcheck with docker, or we can nudge people towards containerd, effectively stopping the healthcheck in that way.

[hakman]

@justinsb I added some release notes for this. Seems something people should read about before upgrading. I don't have any plans to backport this to any release branch, unless you think it would be good to have it in 1.17 also.

Support for Node Problem Detector seems interesting and something we should support. Will look into it.

Not sure if I understand the last part of your last comment. Do you think I should change the default for the health check to be enabled for Docker?

[hakman]

@justinsb the last commit keeps the Docker "health-check" enabled for older versions of Kubernetes running on Debian distros (like the original behaviour). I think this should address the remaining concerns.
https://github.com/kubernetes/kops/pull/8221/files#diff-881677b9520c8452a2d4ce32dc41fdaaR1090

[hakman]

/retest

[johngmyers]

/lgtm

[johngmyers]

nit:

Suggested change

	// HealthCheck enables the periodic health-check service
	// HealthCheck enables the periodic health-check service.

[justinsb]

Thanks @hakman for this, and sorry it took so long to approve

/approve
/lgtm

Looks like we might need a test-output regeneration though, I'm afraid.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: hakman, justinsb

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [justinsb]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hakman]

Thank you @justinsb. With this, the support for containerd should be pretty much done.

[rifelpet]

/lgtm