systemd-cgroup support

[joost14]

Hello,

I'm trying to setup Kubernetes(kubeadm) + CRI-O + runsc. I'm enabling the runtimes through the alpha feature gate RuntimeClass (crio is dropping support for untrusted-workload). I've got it to work with some other runtimes already, but I'm having some issues when trying to run runsc.

The error when I'm starting the pod is the following:
kubelet, k8sworker01 Failed create pod sandbox: rpc error: code = Unknown desc = container create failed: flag provided but not defined: -systemd-cgroup

Crio config file:

  [crio.runtime.runtimes.runsc]
  runtime_path = "/usr/local/bin/runsc"

I was wondering if anyone got runsc working with kubernetes and crio yet.

Edit: when switching the cgroup-manager within the crio config from systemd to groupfs the container wont start at all. Error:
kubelet, k8sworker01 Failed create pod sandbox: rpc error: code = Unknown desc = cri-o configured with cgroupfs cgroup manager, but received systemd slice as parent: /kubepods.slice/kubepods-besteffort.slice/kubepods-besteffort-pode9fd6274_59d1_11e9_af90_9e3c8464d679.slice

Edit2:
Solved it by changing systemd to cgroupfs in crio.conf and in '/etc/default/kubelet':
' KUBELET_EXTRA_ARGS=--cgroup-driver=cgroupfs'

That leaves me with the following question; is 'systemd' not supported yet for gvisor?

[kevinGC]

I believe this is the kubelet and runtime (cri-o) not agreeing on how to manage cgroups for the pod, not something that gVisor doesn't have support for. Based on this doc, some Linux distros require extra configuration.

[joost14]

Hi @kevinGC,

Thanks for the information. Though it is still a bit strange that kata and runc work just fine when using systemd. So this issue may only is the case when using kubelet and crio?

[fvoznika]

runsc doesn't implement the -systemd-cgroup flag. runsc implements cgroups using cgroupfs, as you noted when you set KUBELET_EXTRA_ARGS=--cgroup-driver=cgroupfs. Is that something that works for you?

[joost14]

Hi @fvoznika,

I know runsc doesn't implement the flag. I was just wondering if systemd was compatible with runsc or if it is just some configuration error on my part.

[sdeoras]

I got the same error trying to make runsc work with cri-o. We use systemd as cgroup-driver so I am interested to know if it is possible to make runsc work with this setup? Thanks.

[25077667]

Hi all,

I also meet this problem, but I'm not using the kube. How can I solve it?
I use the raw docker on Archlinux .
This is my platform:

And this is the error message:

[wtfismyip]

@25077667 I ran into this issue both on Debian 11 and Ubuntu 21.10 with normal Docker. Adding systemd.unified_cgroup_hierarchy=false systemd.legacy_systemd_cgroup_controller=false to the kernel boot options fixed it for me.

[25077667]

@25077667 I ran into this issue both on Debian 11 and Ubuntu 21.10 with normal Docker. Adding systemd.unified_cgroup_hierarchy=false systemd.legacy_systemd_cgroup_controller=false to the kernel boot options fixed it for me.

I had found that answer before.
It means canceling the Cgroup V2 option when you boot up.

[arno01]

Possibly solved by these?
#6499
#3481
#6821

[avagin]

Possibly solved by these?

@arno01 these pr-s added the support of cgroupv2, but the systemd cgroup-driver isn't implemented yet. It doesn't mean that you can't use gvisor on systemd systems, but you will need to change the default systemd cgroup-drive to cgroupfs.

[git-noise]

Hello,
Is there any plan to support systemd cgroups in the future (or near future)?

Using cgroupfs may not be an easy option as I believe it is not recommended with kubeadm as mentioned here: https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/configure-cgroup-driver/ ?

While possible to run both in parallel, it seems also not recommended: https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/configure-cgroup-driver/#using-the-cgroupfs-driver

Many thanks,