configure crio to use kube reserved cgroup

[pedro-peter]

What type of PR is this?
/kind bug

What this PR does / why we need it:
Fix for #11027

I think enabling this feature was missed when support for crio was added.

It's enabled for docker using the docker systemd unit file:
https://github.com/kubernetes-sigs/kubespray/blob/master/roles/container-engine/docker/templates/docker.service.j2#L46

there is no ansible j2 template file for the crio systemd unit file as it's currently copied from the crio binary file to the host:
https://github.com/kubernetes-sigs/kubespray/blob/master/roles/container-engine/cri-o/tasks/main.yaml#L88

the best approach in this case seems to be to add a seperate 00-slice.conf file.

with this fix in place, crio will run the correct systemd cgroup slice.

Before:

systemctl status crio.service
● crio.service - Container Runtime Interface for OCI (CRI-O)
   Loaded: loaded (/etc/systemd/system/crio.service; enabled; vendor preset: disabled)
   Active: active (running) since Tue 2024-03-12 10:06:49 PDT; 2 days ago
     Docs: https://github.com/cri-o/cri-o
 Main PID: 2402291 (crio)
    Tasks: 12
   Memory: 86.6M
   CGroup: /system.slice/crio.service <--------- still on system.slice
           └─2402291 /usr/local/bin/crio

After:

systemctl status crio.service
Redirecting to /bin/systemctl status crio.service
● crio.service - Container Runtime Interface for OCI (CRI-O)
   Loaded: loaded (/etc/systemd/system/crio.service; enabled; vendor preset: disabled)
  Drop-In: /etc/systemd/system/crio.service.d
           └─00-slice.conf
   Active: active (running) since Fri 2024-03-22 08:38:25 PDT; 21h ago
     Docs: https://github.com/cri-o/cri-o
 Main PID: 1389453 (crio)
    Tasks: 19
   Memory: 535.6M
   CGroup: /kube.slice/crio.service
           └─1389453 /usr/local/bin/crio

the kubelet errors:

Mar 15 02:28:37 worker01.mycluster.net kubelet[2421710]: E0315 02:28:37.703623 2421710 summary_sys_containers.go:48] "Failed to get system container stats" err="failed to get cgroup stats for \"/kube.slice/crio.service\": failed to get container info for \"/kube.slice/crio.service\": unknown container \"/kube.slice/crio.service\"" containerName="/kube.slice/crio.service"
Mar 15 02:28:45 worker01.mycluster.net kubelet[2421710]: E0315 02:28:45.000770 2421710 summary_sys_containers.go:83] "Failed to get system container stats" err="failed to get cgroup stats for \"/kube.slice/crio.service\": failed to get container info for \"/kube.slice/crio.service\": unknown container \"/kube.slice/crio.service\"" containerName="/kube.slice/crio.service"
Mar 15 02:28:47 worker01.mycluster.net kubelet[2421710]: E0315 02:28:47.717431 2421710 summary_sys_containers.go:48] "Failed to get system container stats" err="failed to get cgroup stats for \"/kube.slice/crio.service\": failed to get container info for \"/kube.slice/crio.service\": unknown container \"/kube.slice/crio.service\"" containerName="/kube.slice/crio.service"

also stop appearing in the logs once crio is restarted with this fix in place.

note: the fix only takes effect when the crio service is restarted. it may not take effect during cluster upgrades unless crio is upgraded (which triggers a crio restart)

Which issue(s) this PR fixes:

Fixes #11027

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

configure crio container runtime to use kube reserved cgroup

[k8s-ci-robot]

Hi @pedro-peter. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[yankay]

/ok-to-test

[VannTen]

Good enough for me !
/lgtm

[VannTen]

I don't really like this is defined dance when we have role defaults, but given how our roles are layed out right now there is no way around it for now, unfortunately.

[VannTen]

note: the fix only takes effect when the crio service is restarted. it may not take effect during cluster upgrades unless crio is upgraded (which triggers a crio restart)

Since you notify the handler "Restart crio", that should not be a problem, it should be restarted if the task added the override.

[yankay]

Thanks @pedro-peter
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: pedro-peter, yankay

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [yankay]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment