[BUG] Pod start failed：failed to write "0-xx": write /sys/fs/cgroup/cpuset/kubepods/besteffort/pod3f915ba0-fad2-4c10-a87f-bebb8290936d/nginx/cpuset.cpus: permission denied: unknown

[wangxiaoq]

What happened:

1. Create a batch priority and BE QoS ClusterColcationProfiles in cluster
2. Create a Pod use the ClusterColcationProfiles above
3. The Pod start failed: Error: failed to create containerd task: OCI runtime create failed: container_linux.go:380: starting container process caused: process_linux.go:385: applying cgroup configuration for process caused: failed to write "0-95": write /sys/fs/cgroup/cpuset/kubepods/besteffort/podbdb70d35-dd7e-4030-bff8-39d860432bc1/nginx/cpuset.cpus: permission denied: unknown

What you expected to happen:

Pod start successfully

How to reproduce it (as minimally and precisely as possible):

See What happened section

Anything else we need to know?:

Environment:

• App version: 0.5.0
• Kubernetes version (use kubectl version): 1.21.0
• Install details (e.g. helm install args):
• Others:

[zwzhang0107]

when cpu suppress strategy enabled, cpuset of besteffort dir will be modified, which will be conflicted if there is cpusets in CRI requests.
so the cpuset of besteffort pod in CRI request should be erased by runtimehooks.cpuset

[jasonliu747]

/area koordlet
/assign @zwzhang0107

[wangxiaoq]

more info:

container runtime: containerd 1.4.11/runc 1.0.2

[zwzhang0107]

#412

[zwzhang0107]

kubelet with static cpu-manage-policy

[jasonliu747]

/close

[koordinator-bot]

@jasonliu747: Closing this issue.

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.