systemd-cgroup support

[joost14]

Hello,

I'm trying to setup Kubernetes(kubeadm) + CRI-O + runsc. I'm enabling the runtimes through the alpha feature gate RuntimeClass (crio is dropping support for untrusted-workload). I've got it to work with some other runtimes already, but I'm having some issues when trying to run runsc.

The error when I'm starting the pod is the following:
kubelet, k8sworker01 Failed create pod sandbox: rpc error: code = Unknown desc = container create failed: flag provided but not defined: -systemd-cgroup

Crio config file:

  [crio.runtime.runtimes.runsc]
  runtime_path = "/usr/local/bin/runsc"

I was wondering if anyone got runsc working with kubernetes and crio yet.

Edit: when switching the cgroup-manager within the crio config from systemd to groupfs the container wont start at all. Error:
kubelet, k8sworker01 Failed create pod sandbox: rpc error: code = Unknown desc = cri-o configured with cgroupfs cgroup manager, but received systemd slice as parent: /kubepods.slice/kubepods-besteffort.slice/kubepods-besteffort-pode9fd6274_59d1_11e9_af90_9e3c8464d679.slice

Edit2:
Solved it by changing systemd to cgroupfs in crio.conf and in '/etc/default/kubelet':
' KUBELET_EXTRA_ARGS=--cgroup-driver=cgroupfs'

That leaves me with the following question; is 'systemd' not supported yet for gvisor?

[kevinGC]

I believe this is the kubelet and runtime (cri-o) not agreeing on how to manage cgroups for the pod, not something that gVisor doesn't have support for. Based on this doc, some Linux distros require extra configuration.

[joost14]

Hi @kevinGC,

Thanks for the information. Though it is still a bit strange that kata and runc work just fine when using systemd. So this issue may only is the case when using kubelet and crio?

[fvoznika]

runsc doesn't implement the -systemd-cgroup flag. runsc implements cgroups using cgroupfs, as you noted when you set KUBELET_EXTRA_ARGS=--cgroup-driver=cgroupfs. Is that something that works for you?

[joost14]

Hi @fvoznika,

I know runsc doesn't implement the flag. I was just wondering if systemd was compatible with runsc or if it is just some configuration error on my part.

[sdeoras]

I got the same error trying to make runsc work with cri-o. We use systemd as cgroup-driver so I am interested to know if it is possible to make runsc work with this setup? Thanks.