From 7d013d5dc6751390bbafa6bded9f9bd9efe3e2d6 Mon Sep 17 00:00:00 2001 From: Oleg Atamanenko Date: Wed, 30 Jun 2021 17:06:25 -0700 Subject: [PATCH] Add podPidsLimit / --pod-max-pids support --- docs/cluster_spec.md | 12 ++++++++++++ k8s/crds/kops.k8s.io_clusters.yaml | 10 ++++++++++ k8s/crds/kops.k8s.io_instancegroups.yaml | 5 +++++ pkg/apis/kops/componentconfig.go | 2 ++ pkg/apis/kops/v1alpha2/componentconfig.go | 2 ++ pkg/apis/kops/v1alpha2/zz_generated.conversion.go | 2 ++ pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go | 5 +++++ pkg/apis/kops/zz_generated.deepcopy.go | 5 +++++ 8 files changed, 43 insertions(+) diff --git a/docs/cluster_spec.md b/docs/cluster_spec.md index 8969a6ccd26f8..53bdd7eae5538 100644 --- a/docs/cluster_spec.md +++ b/docs/cluster_spec.md @@ -686,6 +686,18 @@ spec: housekeepingInterval: 30s ``` +### Pod PIDs Limit +{{ kops_feature_table(kops_added_default='1.22', k8s_min='1.20') }} + +`podPidsLimit` allows to configure the maximum number of pids (process ids) in any pod. +[Read more](https://kubernetes.io/docs/concepts/policy/pid-limiting/) in Kubernetes documentation. + +```yaml +spec: + kubelet: + podPidsLimit: 1024 +``` + ### Event QPS {{ kops_feature_table(kops_added_default='1.19') }} diff --git a/k8s/crds/kops.k8s.io_clusters.yaml b/k8s/crds/kops.k8s.io_clusters.yaml index 09cda80f7db3b..7cacb0dcb4b87 100644 --- a/k8s/crds/kops.k8s.io_clusters.yaml +++ b/k8s/crds/kops.k8s.io_clusters.yaml @@ -2572,6 +2572,11 @@ spec: description: config is the path to the config file or directory of files type: string + podPidsLimit: + description: PodPidsLimit is the maximum number of pids in any + pod. + format: int64 + type: integer protectKernelDefaults: description: 'Default kubelet behaviour for kernel tuning. If set, kubelet errors if any of kernel tunables is different than @@ -2982,6 +2987,11 @@ spec: description: config is the path to the config file or directory of files type: string + podPidsLimit: + description: PodPidsLimit is the maximum number of pids in any + pod. + format: int64 + type: integer protectKernelDefaults: description: 'Default kubelet behaviour for kernel tuning. If set, kubelet errors if any of kernel tunables is different than diff --git a/k8s/crds/kops.k8s.io_instancegroups.yaml b/k8s/crds/kops.k8s.io_instancegroups.yaml index d8388b4619271..5b8895738ee55 100644 --- a/k8s/crds/kops.k8s.io_instancegroups.yaml +++ b/k8s/crds/kops.k8s.io_instancegroups.yaml @@ -526,6 +526,11 @@ spec: description: config is the path to the config file or directory of files type: string + podPidsLimit: + description: PodPidsLimit is the maximum number of pids in any + pod. + format: int64 + type: integer protectKernelDefaults: description: 'Default kubelet behaviour for kernel tuning. If set, kubelet errors if any of kernel tunables is different than diff --git a/pkg/apis/kops/componentconfig.go b/pkg/apis/kops/componentconfig.go index 195fa04a72c17..6a64625d869c3 100644 --- a/pkg/apis/kops/componentconfig.go +++ b/pkg/apis/kops/componentconfig.go @@ -221,6 +221,8 @@ type KubeletConfigSpec struct { ContainerLogMaxFiles *int32 `json:"containerLogMaxFiles,omitempty" flag:"container-log-max-files"` // EnableCadvisorJsonEndpoints enables cAdvisor json `/spec` and `/stats/*` endpoints. Defaults to False. EnableCadvisorJsonEndpoints *bool `json:"enableCadvisorJsonEndpoints,omitempty" flag:"enable-cadvisor-json-endpoints"` + // PodPidsLimit is the maximum number of pids in any pod. + PodPidsLimit *int64 `json:"podPidsLimit,omitempty" flag:"pod-max-pids"` } // KubeProxyConfig defines the configuration for a proxy diff --git a/pkg/apis/kops/v1alpha2/componentconfig.go b/pkg/apis/kops/v1alpha2/componentconfig.go index 3669623938c2e..6353909b6367d 100644 --- a/pkg/apis/kops/v1alpha2/componentconfig.go +++ b/pkg/apis/kops/v1alpha2/componentconfig.go @@ -221,6 +221,8 @@ type KubeletConfigSpec struct { ContainerLogMaxFiles *int32 `json:"containerLogMaxFiles,omitempty" flag:"container-log-max-files"` // EnableCadvisorJsonEndpoints enables cAdvisor json `/spec` and `/stats/*` endpoints. Defaults to False. EnableCadvisorJsonEndpoints *bool `json:"enableCadvisorJsonEndpoints,omitempty" flag:"enable-cadvisor-json-endpoints"` + // PodPidsLimit is the maximum number of pids in any pod. + PodPidsLimit *int64 `json:"podPidsLimit,omitempty" flag:"pod-max-pids"` } // KubeProxyConfig defines the configuration for a proxy diff --git a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go index 91c25bb20c44c..6ecf83083cff7 100644 --- a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go @@ -5217,6 +5217,7 @@ func autoConvert_v1alpha2_KubeletConfigSpec_To_kops_KubeletConfigSpec(in *Kubele out.ContainerLogMaxSize = in.ContainerLogMaxSize out.ContainerLogMaxFiles = in.ContainerLogMaxFiles out.EnableCadvisorJsonEndpoints = in.EnableCadvisorJsonEndpoints + out.PodPidsLimit = in.PodPidsLimit return nil } @@ -5312,6 +5313,7 @@ func autoConvert_kops_KubeletConfigSpec_To_v1alpha2_KubeletConfigSpec(in *kops.K out.ContainerLogMaxSize = in.ContainerLogMaxSize out.ContainerLogMaxFiles = in.ContainerLogMaxFiles out.EnableCadvisorJsonEndpoints = in.EnableCadvisorJsonEndpoints + out.PodPidsLimit = in.PodPidsLimit return nil } diff --git a/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go b/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go index 116eda4e95718..1410e4de581d3 100644 --- a/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go +++ b/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go @@ -3467,6 +3467,11 @@ func (in *KubeletConfigSpec) DeepCopyInto(out *KubeletConfigSpec) { *out = new(bool) **out = **in } + if in.PodPidsLimit != nil { + in, out := &in.PodPidsLimit, &out.PodPidsLimit + *out = new(int64) + **out = **in + } return } diff --git a/pkg/apis/kops/zz_generated.deepcopy.go b/pkg/apis/kops/zz_generated.deepcopy.go index 249bc1a77c152..bfd34e3b6dfca 100644 --- a/pkg/apis/kops/zz_generated.deepcopy.go +++ b/pkg/apis/kops/zz_generated.deepcopy.go @@ -3633,6 +3633,11 @@ func (in *KubeletConfigSpec) DeepCopyInto(out *KubeletConfigSpec) { *out = new(bool) **out = **in } + if in.PodPidsLimit != nil { + in, out := &in.PodPidsLimit, &out.PodPidsLimit + *out = new(int64) + **out = **in + } return }