From 47149a5483d3c981427415db1d45dc7678358dbb Mon Sep 17 00:00:00 2001 From: Teoman ONAY Date: Tue, 3 Aug 2021 16:06:53 +0200 Subject: [PATCH] podman pids.max default value is 2048, docker's one is 4096 which are sufficient for the default value (512) of rgw thread pool size. But if its value is increased near to the pids-limit value, it does not leave place for the other processes to spawn and run within the container and the container crashes. pids-limit set to unlimited regardless of the container engine. Closes: https://bugzilla.redhat.com/show_bug.cgi?id=1987041 Signed-off-by: Teoman ONAY (cherry picked from commit 9b5d97adb95a788bc1fdedbba562a9c71a1808be) --- roles/ceph-crash/templates/ceph-crash.service.j2 | 1 + roles/ceph-grafana/templates/grafana-server.service.j2 | 1 + roles/ceph-iscsi-gw/templates/rbd-target-api.service.j2 | 1 + roles/ceph-iscsi-gw/templates/rbd-target-gw.service.j2 | 1 + roles/ceph-iscsi-gw/templates/tcmu-runner.service.j2 | 1 + roles/ceph-mds/templates/ceph-mds.service.j2 | 1 + roles/ceph-mgr/templates/ceph-mgr.service.j2 | 1 + roles/ceph-mon/templates/ceph-mon.service.j2 | 1 + roles/ceph-nfs/templates/ceph-nfs.service.j2 | 1 + roles/ceph-node-exporter/templates/node_exporter.service.j2 | 1 + roles/ceph-osd/templates/ceph-osd.service.j2 | 1 + roles/ceph-prometheus/templates/alertmanager.service.j2 | 1 + roles/ceph-prometheus/templates/prometheus.service.j2 | 1 + roles/ceph-rbd-mirror/templates/ceph-rbd-mirror.service.j2 | 1 + roles/ceph-rgw/templates/ceph-radosgw.service.j2 | 1 + 15 files changed, 15 insertions(+) diff --git a/roles/ceph-crash/templates/ceph-crash.service.j2 b/roles/ceph-crash/templates/ceph-crash.service.j2 index fd94689210..5343d02df8 100644 --- a/roles/ceph-crash/templates/ceph-crash.service.j2 +++ b/roles/ceph-crash/templates/ceph-crash.service.j2 @@ -17,6 +17,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --name ceph-crash-%i \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} +--pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --net=host \ -v /var/lib/ceph:/var/lib/ceph:z \ -v /etc/localtime:/etc/localtime:ro \ diff --git a/roles/ceph-grafana/templates/grafana-server.service.j2 b/roles/ceph-grafana/templates/grafana-server.service.j2 index 1fb57f3166..da82bd5864 100644 --- a/roles/ceph-grafana/templates/grafana-server.service.j2 +++ b/roles/ceph-grafana/templates/grafana-server.service.j2 @@ -22,6 +22,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --name=grafana-server \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ -v /etc/grafana:/etc/grafana:Z \ -v /var/lib/grafana:/var/lib/grafana:Z \ --net=host \ diff --git a/roles/ceph-iscsi-gw/templates/rbd-target-api.service.j2 b/roles/ceph-iscsi-gw/templates/rbd-target-api.service.j2 index 7adc3b4317..f480c7a075 100644 --- a/roles/ceph-iscsi-gw/templates/rbd-target-api.service.j2 +++ b/roles/ceph-iscsi-gw/templates/rbd-target-api.service.j2 @@ -21,6 +21,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --memory={{ ceph_rbd_target_api_docker_memory_limit }} \ --cpus={{ ceph_rbd_target_api_docker_cpu_limit }} \ -v /etc/localtime:/etc/localtime:ro \ diff --git a/roles/ceph-iscsi-gw/templates/rbd-target-gw.service.j2 b/roles/ceph-iscsi-gw/templates/rbd-target-gw.service.j2 index 78397e126e..0b3a049363 100644 --- a/roles/ceph-iscsi-gw/templates/rbd-target-gw.service.j2 +++ b/roles/ceph-iscsi-gw/templates/rbd-target-gw.service.j2 @@ -21,6 +21,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --memory={{ ceph_rbd_target_gw_docker_memory_limit }} \ --cpus={{ ceph_rbd_target_gw_docker_cpu_limit }} \ -v /etc/localtime:/etc/localtime:ro \ diff --git a/roles/ceph-iscsi-gw/templates/tcmu-runner.service.j2 b/roles/ceph-iscsi-gw/templates/tcmu-runner.service.j2 index 6d9dc3bf7c..d35917f87d 100644 --- a/roles/ceph-iscsi-gw/templates/tcmu-runner.service.j2 +++ b/roles/ceph-iscsi-gw/templates/tcmu-runner.service.j2 @@ -21,6 +21,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --memory={{ ceph_tcmu_runner_docker_memory_limit }} \ --cpus={{ ceph_tcmu_runner_docker_cpu_limit }} \ -v /etc/localtime:/etc/localtime:ro \ diff --git a/roles/ceph-mds/templates/ceph-mds.service.j2 b/roles/ceph-mds/templates/ceph-mds.service.j2 index c681146cbc..54b2d7ac8d 100644 --- a/roles/ceph-mds/templates/ceph-mds.service.j2 +++ b/roles/ceph-mds/templates/ceph-mds.service.j2 @@ -22,6 +22,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --net=host \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --memory={{ ceph_mds_docker_memory_limit }} \ --cpus={{ cpu_limit }} \ -v /var/lib/ceph:/var/lib/ceph:z \ diff --git a/roles/ceph-mgr/templates/ceph-mgr.service.j2 b/roles/ceph-mgr/templates/ceph-mgr.service.j2 index 56c49c4a6d..2cca6364ba 100644 --- a/roles/ceph-mgr/templates/ceph-mgr.service.j2 +++ b/roles/ceph-mgr/templates/ceph-mgr.service.j2 @@ -21,6 +21,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --net=host \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --memory={{ ceph_mgr_docker_memory_limit }} \ --cpus={{ ceph_mgr_docker_cpu_limit }} \ -v /var/lib/ceph:/var/lib/ceph:z,rshared \ diff --git a/roles/ceph-mon/templates/ceph-mon.service.j2 b/roles/ceph-mon/templates/ceph-mon.service.j2 index ed95cc60b9..bdcc1063ba 100644 --- a/roles/ceph-mon/templates/ceph-mon.service.j2 +++ b/roles/ceph-mon/templates/ceph-mon.service.j2 @@ -22,6 +22,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --name ceph-mon-%i \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --memory={{ ceph_mon_docker_memory_limit }} \ --cpus={{ ceph_mon_docker_cpu_limit }} \ -v /var/lib/ceph:/var/lib/ceph:z,rshared \ diff --git a/roles/ceph-nfs/templates/ceph-nfs.service.j2 b/roles/ceph-nfs/templates/ceph-nfs.service.j2 index f3e3ac4bf5..e053788e87 100644 --- a/roles/ceph-nfs/templates/ceph-nfs.service.j2 +++ b/roles/ceph-nfs/templates/ceph-nfs.service.j2 @@ -21,6 +21,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --net=host \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ -v /var/lib/ceph:/var/lib/ceph:z \ -v /etc/ceph:/etc/ceph:z \ -v /var/lib/nfs/ganesha:/var/lib/nfs/ganesha:z \ diff --git a/roles/ceph-node-exporter/templates/node_exporter.service.j2 b/roles/ceph-node-exporter/templates/node_exporter.service.j2 index d3228a1192..346c84e626 100644 --- a/roles/ceph-node-exporter/templates/node_exporter.service.j2 +++ b/roles/ceph-node-exporter/templates/node_exporter.service.j2 @@ -20,6 +20,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --name=node-exporter \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --privileged \ -v /proc:/host/proc:ro -v /sys:/host/sys:ro \ --net=host \ diff --git a/roles/ceph-osd/templates/ceph-osd.service.j2 b/roles/ceph-osd/templates/ceph-osd.service.j2 index fb179dde50..75ea7195ac 100644 --- a/roles/ceph-osd/templates/ceph-osd.service.j2 +++ b/roles/ceph-osd/templates/ceph-osd.service.j2 @@ -27,6 +27,7 @@ numactl \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --rm \ --net=host \ --privileged=true \ diff --git a/roles/ceph-prometheus/templates/alertmanager.service.j2 b/roles/ceph-prometheus/templates/alertmanager.service.j2 index 28280c3d68..a621c8a764 100644 --- a/roles/ceph-prometheus/templates/alertmanager.service.j2 +++ b/roles/ceph-prometheus/templates/alertmanager.service.j2 @@ -21,6 +21,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --name=alertmanager \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ -v "{{ alertmanager_conf_dir }}:/etc/alertmanager:Z" \ -v "{{ alertmanager_data_dir }}:/alertmanager:Z" \ --net=host \ diff --git a/roles/ceph-prometheus/templates/prometheus.service.j2 b/roles/ceph-prometheus/templates/prometheus.service.j2 index 3f2ed5602a..8202cf22ef 100644 --- a/roles/ceph-prometheus/templates/prometheus.service.j2 +++ b/roles/ceph-prometheus/templates/prometheus.service.j2 @@ -20,6 +20,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --name=prometheus \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ -v "{{ prometheus_conf_dir }}:/etc/prometheus:Z" \ -v "{{ prometheus_data_dir }}:/prometheus:Z" \ --net=host \ diff --git a/roles/ceph-rbd-mirror/templates/ceph-rbd-mirror.service.j2 b/roles/ceph-rbd-mirror/templates/ceph-rbd-mirror.service.j2 index 48c0b3d17b..c9e87acdd7 100644 --- a/roles/ceph-rbd-mirror/templates/ceph-rbd-mirror.service.j2 +++ b/roles/ceph-rbd-mirror/templates/ceph-rbd-mirror.service.j2 @@ -21,6 +21,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --net=host \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --memory={{ ceph_rbd_mirror_docker_memory_limit }} \ --cpus={{ ceph_rbd_mirror_docker_cpu_limit }} \ -v /var/lib/ceph:/var/lib/ceph:z \ diff --git a/roles/ceph-rgw/templates/ceph-radosgw.service.j2 b/roles/ceph-rgw/templates/ceph-radosgw.service.j2 index 7c007e5bdf..881b970abf 100644 --- a/roles/ceph-rgw/templates/ceph-radosgw.service.j2 +++ b/roles/ceph-rgw/templates/ceph-radosgw.service.j2 @@ -22,6 +22,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --net=host \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --memory={{ ceph_rgw_docker_memory_limit }} \ --cpus={{ cpu_limit }} \ {% if ceph_rgw_docker_cpuset_cpus is defined -%}