GKE集群中Windows容器无法调度问题求助

大家好，我正在尝试把Windows容器部署到GKE的Windows节点池上，已经专门创建了一个节点池，镜像类型是带containerd的Windows长期服务通道（windows_ltsc_containerd），但部署时遇到了 admission webhook 拒绝请求的错误，想请教一下各位我哪里配置错了？麻烦大家帮忙指导，非常感谢！

报错信息： #

message: >-
admission webhook "windows.common-webhooks.networking.gke.io" denied the
request: [spec.volumes[3].volumeSource.emptyDir.medium: Unsupported
value: "Memory": supported values: "\"\" (empty string indicates disk
for Windows)", spec.initContainers[0].securityContext: Invalid value:
v1.SecurityContext{Capabilities:(*v1.Capabilities)(0xc00096ad80),
Privileged:(*bool)(0xc000bdfc13),
SELinuxOptions:(*v1.SELinuxOptions)(nil),
WindowsOptions:(*v1.WindowsSecurityContextOptions)(nil),
RunAsUser:(*int64)(0xc000bdfc18), RunAsGroup:(*int64)(0xc000bdfc20),
RunAsNonRoot:(*bool)(0xc000bdfc28),
ReadOnlyRootFilesystem:(*bool)(0xc000bdfc29),
AllowPrivilegeEscalation:(*bool)(0xc000bdfc2a),
ProcMount:(*v1.ProcMountType)(nil),
SeccompProfile:(*v1.SeccompProfile)(nil)}: Windows does not support this
field. Note that defaults may be allowed for compatibility.,
spec.containers[1].securityContext: Invalid value:
v1.SecurityContext{Capabilities:(*v1.Capabilities)(0xc00096ae10),
Privileged:(*bool)(0xc000bdfe7f),
SELinuxOptions:(*v1.SELinuxOptions)(nil),
WindowsOptions:(*v1.WindowsSecurityContextOptions)(nil),
RunAsUser:(*int64)(0xc000bdfe90), RunAsGroup:(*int64)(0xc000bdfea0),
RunAsNonRoot:(*bool)(0xc000bdfeac),
ReadOnlyRootFilesystem:(*bool)(0xc000bdfead),
AllowPrivilegeEscalation:(*bool)(0xc000bdfeae),
ProcMount:(*v1.ProcMountType)(nil),
SeccompProfile:(*v1.SeccompProfile)(nil)}: Windows does not support this
field. Note that defaults may be allowed for compatibility.]

我的Dockerfile： #

FROM mcr.microsoft.com/dotnet/framework/sdk:4.8 AS build
# set the working directory inside compilation container to c:\app
WORKDIR /app
# copy everything from solution dir into the c:\app
COPY . .
# restore nuget packages
RUN nuget restore -PackagesDirectory "Mycompany.InvoiceCloud.Web/"
RUN msbuild "Mycompany.InvoiceCloud.Web/Mycompany.InvoiceCloud.Web.csproj" /v:diag

# start with new base image for running asp.net apps (which contains IIS)
FROM mcr.microsoft.com/dotnet/framework/aspnet:4.8 AS runtime
WORKDIR /inetpub/wwwroot
COPY --from=build /app/Mycompany.InvoiceCloud.Web/bin .

我的Deployment配置文件： #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: dev-invoicecloud-web
spec:
  replicas: 1
  selector:
    matchLabels:
      app: dev-invoicecloud-web
  template:
    metadata:
      labels:
        app: dev-invoicecloud-web
    spec:
      nodeSelector:
        kubernetes.io/os: windows
      containers:
      - name: dev-invoicecloud-web
        image: gcr.io/invoicecloudweb:latest
        ports:
        - containerPort: 80

我自己初步排查的问题点： #

• EmptyDir卷的medium: Memory配置在Windows容器中不被支持，Windows仅支持磁盘存储的EmptyDir（用空字符串表示）
• Windows容器不支持Linux风格的securityContext字段（比如Capabilities、Privileged这类参数），如果需要配置安全相关选项，得使用Windows专用的WindowsSecurityContextOptions

但我不确定是否还有其他遗漏的配置，想请大家帮忙确认修改方向是否正确，或者还有哪些需要调整的地方？

备注：内容来源于stack exchange，提问作者iamattiq1991