Aks-engine: Is the new Windows OS version 10.0.17763.1039 compatible with AKS Engine/Kubernetes?

[wumingcp]

Describe the request

Is the new Windows OS version 10.0.17763.1039 compatible with AKS Engine/Kubernetes

Explain why AKS Engine needs it

As the new Windows OS version 10.0.17763.1039 has been released, and it fixes some sucurity issues. To meet security requirements, we need to upgrade Windows nodes on k8s cluster to that version, and the k8s cluster is deployed to Azure by AKS Engine, so we want to know is the version 1039 compatible with AKS Engine/Kubernetes

https://support.microsoft.com/en-us/help/4532691/windows-10-update-kb4532691

Describe the solution you'd like

Please update the compatibility information about 1039 version in the release notes as you always do, thanks

Additional context
AKS Engine Version: 0.40.0
Kubernetes Version: 1.13
Current Windows OS version: 17763.973.2001110547

[welcome[bot]]

👋 Thanks for opening your first issue here! If you're reporting a 🐞 bug, please make sure you include steps to reproduce it.

[DreamRivulet]

There's a known issue this update: https://support.microsoft.com/en-sg/help/4542617/you-may-encounter-issues-when-using-windows-server-docker-container-im
If this update is installed on windows container, then the container will become unresponsive...
One suggested mitigation way is :
"We strongly recommend to update the container host to the February 11, 2020 security update for Windows (note: both the container and host need to be on the same Windows version, i.e. 1809, 1903, etc.) "

So may i know when this update will be available for AKS Engine windows ?

[jackfrancis]

@marosset are you able to answer these questions?

[marosset]

The problems listed in the support article above are less related to aks-engine/kubernetes and more related to starting containers on Windows in general.

If your container images are able to start/run on hosts running 10.0.17763.1039 (Feb 2020 patches) then your container images should run fine in kubernetes clusters with hosts also running 10.0.17763.1039.

On Feb 18th new nanoserver and servercore container images were published that should should be able run on 10.0.17763.973 hosts (and lower) with the exception of 32-bit container apps (which must run on 10.0.17763.1039+ hosts).

It is up to each cluster operator to ensure that their container images start/run successfully on new hosts.

[marosset]

We plan on making 10.0.17763.1039 the default in aks-engine sometime this week.
As always you can specify the exact image version used in the clusterdefinition / apimodel file.
https://github.com/Azure/aks-engine/blob/master/docs/topics/clusterdefinitions.md#marketplace-images

[wumingcp]

Is that recommanded both container image and host upgrade to 10.0.17763.1039 if we want to run some 32-bit container apps?

[marosset]

I haven't tested 32-bit container apps with 10.0.17763.1039 and our guidance is always to test things in your environment.

I do however see the following wording in https://support.microsoft.com/en-sg/help/4542617/you-might-encounter-issues-when-using-windows-server-containers-with-t under the Mitigation for 32-bit applications silently failing...

you will need to match the build and revision version of the container image with the build and revision version of your container host operating system.  For instructions on how to check the version of your container host

So it may be a requirement to match container and host images for 32 bit apps if either has Feb patches installed.

[wumingcp]

Thanks very much, it's very helpful for us, and we will use 10.0.17763.1039 for container image and host to fix the issue about 32-bit app silently failing and to meet security requirement