pause image: Disable DiagTrack service on Windows image #95950

claudiubelu · 2020-10-28T14:24:49Z

What type of PR is this?

/kind bug

/sig windows
/sig node

What this PR does / why we need it:

It has been observed that the DiagTrack service in the pause image is consuming a non-trivial amount of CPU. We don't need
this service in the pause image, so we should disable it.

We can disable the service by running chntpw in a docker buildx Linux stage and then copy the SYSTEM file back to the final Windows image.

Co-Authored-By: Mark Rossetti marosset@microsoft.com

Which issue(s) this PR fixes:

Partially Fixes #95735

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

k8s-ci-robot · 2020-10-28T14:24:56Z

@claudiubelu: This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

claudiubelu · 2020-10-28T14:25:36Z

/cc @marosset @dims

marosset · 2020-10-28T16:28:22Z

We also have #95840 for tracking this issue specifically.

marosset · 2020-10-28T16:31:15Z

/lgtm
/milestone v1.20

dims · 2020-10-28T16:34:34Z

/release-note-none

dims · 2020-10-28T16:35:32Z

build/pause/Dockerfile_windows

+COPY --from=windows-base /Windows/System32/config/SYSTEM /windows/
+
+RUN apk add chntpw
+RUN printf "ed ControlSet001\Services\DiagTrack\Start\n\


very interesting technique :)

We were REALLY hoping to be able to do this and still build on Linux machines.

build/pause/Dockerfile_windows

dims · 2020-10-28T16:36:33Z

@claudiubelu one nit. LGTM

dims · 2020-10-28T19:13:48Z

/lgtm

dims · 2020-11-03T23:19:27Z

@marosset @claudiubelu - ooh! one more what happens if you just ensure that diagtrack related dll/exe are excluded from the final image? (delete the thing! or don't copy it over)

marosset · 2020-11-04T04:47:47Z

ooh! one more what happens if you just ensure that diagtrack related dll/exe are excluded from the final image? (delete the thing! or don't copy it over)

@dims It looks like this will actually work....!

I wrote some garbage into a file, named it diagtrack.dll, then copied it over the actual dll with
ADD diagtack.dll /Windows/System32/diagtrack.dll

When I exec into the detached pause image I see

C:\>sc.exe query diagtrack
[SC] EnumQueryServicesStatus:OpenService FAILED 1060:

The specified service does not exist as an installed service.


C:\>REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\DiagTrack
ERROR: The system was unable to find the specified registry key or value.

C:\>REG QUERY HKLM\SYSTEM\CurrentControlSet\Services

<snip>
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\condrv
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptSvc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DCLocator
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DcomLaunch
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dfsc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\disk
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache
</snip>

It looks like the service never existed now - which is really strange...

dims · 2020-11-04T05:09:32Z

LOL i swear i haven't touched a windows box for over a decade. So i have no clue :)

claudiubelu · 2020-11-04T10:22:13Z

LOL i swear i haven't touched a windows box for over a decade. So i have no clue :)

You might have just found your true calling. :D Come, join us. :D

IMO, we could go with the solution proposed by dims. The image can be built: https://paste.ubuntu.com/p/kDJzrqtyxF/ , and checking the service on the newly built images on all the different hosts shows that the DiagTrack service is STOPPED: https://paste.ubuntu.com/p/7Vy6CzsqJp/

It has been observed that the DiagTrack service in the pause image is consuming a non-trivial amount of CPU. We don't need this service in the pause image, so we should disable it. We can disable the service by running chntpw in a docker buildx Linux stage and then copy the SYSTEM file back to the final Windows image. Co-Authored-By: Mark Rossetti <marosset@microsoft.com> Co-Authored-By: Davanum Srinivas <davanum@gmail.com>

claudiubelu · 2020-11-04T11:22:46Z

/test pull-kubernetes-bazel-test

dims · 2020-11-04T13:21:19Z

/approve

Do we need to update version #?

claudiubelu · 2020-11-04T13:35:55Z

We've bumped the pause image version to 3.4 with the initial Windows support in the image. That version has not been published / promoted yet [1]. It would be a good question if we should promote pause:3.4 as is, or include this PR into it, especially considering the DiagTrack CPU consumption issue. @marosset , what do you think?

[1] https://github.com/kubernetes/k8s.io/blob/master/k8s.gcr.io/images/k8s-staging-kubernetes/images.yaml#L1273

marosset · 2020-11-04T17:26:33Z

Since we haven't published/promoted this yet and we this change will help with resource consumption I think we should include this change in pause:3.4

marosset · 2020-11-04T19:05:25Z

LGTM but someone else should probably add the label since I am listed as a co-author on this PR :)

k8s-ci-robot · 2020-11-04T19:10:17Z

@marosset: GitHub didn't allow me to assign the following users: m2.

Note that only kubernetes members, repo collaborators and people who have commented on this issue/PR can be assigned. Additionally, issues/PRs can only have 10 assignees at the same time.
For more information please see the contributor guide

In response to this:

/assign @m2

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

marosset · 2020-11-04T19:10:34Z

/assign @michmike

jsturtevant · 2020-11-05T17:50:10Z

/lgtm

michmike

/lgtm
/approve

k8s-ci-robot · 2020-11-05T18:31:57Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: claudiubelu, dims, michmike

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~build/pause/OWNERS~~ [dims]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

michmike · 2020-11-05T18:32:00Z

good workaround :)

marosset · 2020-11-05T21:12:09Z

/hold cancel

k8s-ci-robot added the needs-priority Indicates a PR lacks a `priority/foo` label and requires one. label Oct 28, 2020

k8s-ci-robot requested review from dims, marosset and listx October 28, 2020 14:25

jsturtevant mentioned this pull request Oct 28, 2020

ci: Windows VHD pipeline tests Azure/aks-engine#3977

Merged

8 tasks

k8s-ci-robot added this to the v1.20 milestone Oct 28, 2020

k8s-ci-robot assigned marosset Oct 28, 2020

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Oct 28, 2020

k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Oct 28, 2020

dims reviewed Oct 28, 2020

View reviewed changes

build/pause/Dockerfile_windows Outdated Show resolved Hide resolved

claudiubelu force-pushed the pause-diag-track branch from a0e51fd to 9a57dc2 Compare October 28, 2020 17:30

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Oct 28, 2020

k8s-ci-robot assigned dims Oct 28, 2020

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Oct 28, 2020

claudiubelu force-pushed the pause-diag-track branch from 9a57dc2 to 3f7c09e Compare November 4, 2020 10:24

k8s-ci-robot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. and removed lgtm "Looks good to me", indicates that a PR is ready to be merged. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Nov 4, 2020

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 4, 2020

k8s-ci-robot assigned michmike Nov 4, 2020

k8s-ci-robot assigned jsturtevant Nov 5, 2020

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 5, 2020

michmike approved these changes Nov 5, 2020

View reviewed changes

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 5, 2020

k8s-ci-robot merged commit 1fdd68f into kubernetes:master Nov 5, 2020

SIG-Windows automation moved this from In Progress (v1.20) to Done (v1.20) Nov 5, 2020

zhiweiv mentioned this pull request Dec 2, 2021

Disable DiagTrack service in Windows pod kubernetes-sigs/azuredisk-csi-driver#1101

Closed

mainred mentioned this pull request Jan 7, 2022

feat: Disable DiagTrack service on Windows image kubernetes-sigs/azuredisk-csi-driver#1102

Closed

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

pause image: Disable DiagTrack service on Windows image #95950

pause image: Disable DiagTrack service on Windows image #95950

claudiubelu commented Oct 28, 2020

k8s-ci-robot commented Oct 28, 2020

claudiubelu commented Oct 28, 2020

marosset commented Oct 28, 2020

marosset commented Oct 28, 2020

dims commented Oct 28, 2020

dims Oct 28, 2020

marosset Oct 28, 2020

dims commented Oct 28, 2020

dims commented Oct 28, 2020

dims commented Nov 3, 2020

marosset commented Nov 4, 2020

dims commented Nov 4, 2020

claudiubelu commented Nov 4, 2020

claudiubelu commented Nov 4, 2020

dims commented Nov 4, 2020

claudiubelu commented Nov 4, 2020

marosset commented Nov 4, 2020

marosset commented Nov 4, 2020

k8s-ci-robot commented Nov 4, 2020

marosset commented Nov 4, 2020

jsturtevant commented Nov 5, 2020

michmike left a comment

k8s-ci-robot commented Nov 5, 2020

michmike commented Nov 5, 2020

marosset commented Nov 5, 2020

pause image: Disable DiagTrack service on Windows image #95950

pause image: Disable DiagTrack service on Windows image #95950

Conversation

claudiubelu commented Oct 28, 2020

k8s-ci-robot commented Oct 28, 2020

claudiubelu commented Oct 28, 2020

marosset commented Oct 28, 2020

marosset commented Oct 28, 2020

dims commented Oct 28, 2020

dims Oct 28, 2020

Choose a reason for hiding this comment

marosset Oct 28, 2020

Choose a reason for hiding this comment

dims commented Oct 28, 2020

dims commented Oct 28, 2020

dims commented Nov 3, 2020

marosset commented Nov 4, 2020

dims commented Nov 4, 2020

claudiubelu commented Nov 4, 2020

claudiubelu commented Nov 4, 2020

dims commented Nov 4, 2020

claudiubelu commented Nov 4, 2020

marosset commented Nov 4, 2020

marosset commented Nov 4, 2020

k8s-ci-robot commented Nov 4, 2020

marosset commented Nov 4, 2020

jsturtevant commented Nov 5, 2020

michmike left a comment

Choose a reason for hiding this comment

k8s-ci-robot commented Nov 5, 2020

michmike commented Nov 5, 2020

marosset commented Nov 5, 2020