mirrors/talos
1
0
Fork 0
mirror of https://github.com/siderolabs/talos.git synced 2026-05-05 04:16:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: update the cgroups for Talos core services

Browse Source 
There was a bit of a mess here which worked fine until we bumped
runc/containerd, and the problem shows up in Talos-in-Kubernetes tests.

Use consistently `runner.WithCgroupPath`, as it handles cgroup nesting
for cases when Talos runs in a container.

Assign each service its own unique cgroup.

Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
This commit is contained in:
Andrey Smirnov 2024-06-06 16:45:49 +04:00
parent fe317f1e16
commit 80ca8ff713
No known key found for this signature in database
GPG Key ID: FE042E3D4085A811
7 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_sequencer_tasks.go
View File

@ -170,6 +170,8 @@ func CreateSystemCgroups(runtime.Sequence, any) (runtime.TaskExecutionFunc, stri
return fmt.Errorf("error initializing cgroups root path: %w", err)
}
logger.Printf("using cgroups root: %s", cgroup.Root())
groups := []struct {
name string
resources *cgroup2.Resources

1
internal/app/machined/pkg/system/services/apid.go
View File

@ -192,6 +192,7 @@ func (o *APID) Runner(r runtime.Runtime) (runner.Runner, error) {
runner.WithLoggingManager(r.Logging()),
runner.WithContainerdAddress(constants.SystemContainerdAddress),
runner.WithEnv(env),
runner.WithCgroupPath(constants.CgroupApid),
runner.WithOCISpecOpts(
oci.WithDroppedCapabilities(cap.Known()),
oci.WithHostNamespace(specs.NetworkNamespace),

1
internal/app/machined/pkg/system/services/etcd.go
View File

@ -218,6 +218,7 @@ func (e *Etcd) Runner(r runtime.Runtime) (runner.Runner, error) {
runner.WithNamespace(constants.SystemContainerdNamespace),
runner.WithContainerImage(e.imgRef),
runner.WithEnv(env),
runner.WithCgroupPath(constants.CgroupEtcd),
runner.WithOCISpecOpts(
oci.WithDroppedCapabilities(cap.Known()),
oci.WithHostNamespace(specs.NetworkNamespace),

2
internal/app/machined/pkg/system/services/extension.go
View File

@ -113,7 +113,6 @@ func (svc *Extension) getOCIOptions(envVars []string, mounts []specs.Mount) []oc
ociOpts := []oci.SpecOpts{
oci.WithRootFSPath(filepath.Join(constants.ExtensionServiceRootfsPath, svc.Spec.Name)),
containerd.WithRootfsPropagation(svc.Spec.Container.Security.RootfsPropagation),
oci.WithCgroup(filepath.Join(constants.CgroupExtensions, svc.Spec.Name)),
oci.WithMounts(mounts),
oci.WithHostNamespace(specs.NetworkNamespace),
oci.WithSelinuxLabel(""),
@ -216,6 +215,7 @@ func (svc *Extension) Runner(r runtime.Runtime) (runner.Runner, error) {
runner.WithContainerdAddress(constants.SystemContainerdAddress),
runner.WithEnv(environment.Get(r.Config())),
runner.WithOCISpecOpts(ociSpecOpts...),
runner.WithCgroupPath(filepath.Join(constants.CgroupExtensions, svc.Spec.Name)),
runner.WithOOMScoreAdj(-600),
),
restart.WithType(restartType),

2
internal/app/machined/pkg/system/services/kubelet.go
View File

@ -157,9 +157,9 @@ func (k *Kubelet) Runner(r runtime.Runtime) (runner.Runner, error) {
runner.WithNamespace(constants.SystemContainerdNamespace),
runner.WithContainerImage(k.imgRef),
runner.WithEnv(environment.Get(r.Config())),
runner.WithCgroupPath(constants.CgroupKubelet),
runner.WithOCISpecOpts(
containerd.WithRootfsPropagation("shared"),
oci.WithCgroup(constants.CgroupKubelet),
oci.WithMounts(mounts),
oci.WithHostNamespace(specs.NetworkNamespace),
oci.WithHostNamespace(specs.PIDNamespace),

1
internal/app/machined/pkg/system/services/trustd.go
View File

@ -155,6 +155,7 @@ func (t *Trustd) Runner(r runtime.Runtime) (runner.Runner, error) {
runner.WithLoggingManager(r.Logging()),
runner.WithContainerdAddress(constants.SystemContainerdAddress),
runner.WithEnv(env),
runner.WithCgroupPath(constants.CgroupTrustd),
runner.WithOCISpecOpts(
containerd.WithMemoryLimit(int64(1000000*512)),
oci.WithDroppedCapabilities(cap.Known()),

9
pkg/machinery/constants/constants.go
View File

@ -666,6 +666,12 @@ const (
// CgroupSystemRuntime is the cgroup name for containerd runtime processes.
CgroupSystemRuntime = CgroupSystem + "/runtime"
// CgroupApid is the cgroup name for apid runtime processes.
CgroupApid = CgroupSystem + "/apid"
// CgroupTrustd is the cgroup name for trustd runtime processes.
CgroupTrustd = CgroupSystem + "/trustd"
// CgroupUdevd is the cgroup name for udevd runtime processes.
CgroupUdevd = CgroupSystem + "/udevd"
@ -681,6 +687,9 @@ const (
// CgroupPodRuntimeReservedMemory is the hard memory protection for the cri runtime processes.
CgroupPodRuntimeReservedMemory = 128 * 1024 * 1024
// CgroupEtcd is the cgroup name for etcd process.
CgroupEtcd = "/podruntime/etcd"
// CgroupKubelet is the cgroup name for kubelet process.
CgroupKubelet = "/podruntime/kubelet"