Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Consolidate sysctl commands for kubelet #43005

Merged
merged 1 commit into from Jun 7, 2017
Merged

Consolidate sysctl commands for kubelet #43005

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
38 changes: 0 additions & 38 deletions cmd/kubelet/app/server.go
View file
Open in desktop
Expand Up @@ -21,7 +21,6 @@ import (
"crypto/tls"
"errors"
"fmt"
"io/ioutil"
"math/rand"
"net"
"net/http"
Expand All @@ -30,7 +29,6 @@ import (
"os"
"path"
"strconv"
"strings"
"time"

"github.com/golang/glog"
Expand Down Expand Up @@ -824,42 +822,6 @@ func RunKubelet(kubeFlags *options.KubeletFlags, kubeCfg *componentconfig.Kubele

rlimit.RlimitNumFiles(uint64(kubeCfg.MaxOpenFiles))

// TODO(dawnchen): remove this once we deprecated old debian containervm images.
// This is a workaround for issue: https://github.com/opencontainers/runc/issues/726
// The current chosen number is consistent with most of other os dist.
const maxKeysPath = "/proc/sys/kernel/keys/root_maxkeys"
const minKeys uint64 = 1000000
key, err := ioutil.ReadFile(maxKeysPath)
if err != nil {
glog.Errorf("Cannot read keys quota in %s", maxKeysPath)
} else {
fields := strings.Fields(string(key))
nKey, _ := strconv.ParseUint(fields[0], 10, 64)
if nKey < minKeys {
glog.Infof("Setting keys quota in %s to %d", maxKeysPath, minKeys)
err = ioutil.WriteFile(maxKeysPath, []byte(fmt.Sprintf("%d", uint64(minKeys))), 0644)
if err != nil {
glog.Warningf("Failed to update %s: %v", maxKeysPath, err)
}
}
}
const maxBytesPath = "/proc/sys/kernel/keys/root_maxbytes"
const minBytes uint64 = 25000000
bytes, err := ioutil.ReadFile(maxBytesPath)
if err != nil {
glog.Errorf("Cannot read keys bytes in %s", maxBytesPath)
} else {
fields := strings.Fields(string(bytes))
nByte, _ := strconv.ParseUint(fields[0], 10, 64)
if nByte < minBytes {
glog.Infof("Setting keys bytes in %s to %d", maxBytesPath, minBytes)
err = ioutil.WriteFile(maxBytesPath, []byte(fmt.Sprintf("%d", uint64(minBytes))), 0644)
if err != nil {
glog.Warningf("Failed to update %s: %v", maxBytesPath, err)
}
}
}

// process pods and exit.
if runOnce {
if _, err := k.RunOnce(podCfg.Updates()); err != nil {
Expand Down
2 changes: 2 additions & 0 deletions pkg/kubelet/cm/container_manager_linux.go
View file
Open in desktop
Expand Up @@ -312,6 +312,8 @@ func setupKernelTunables(option KernelTunableBehavior) error {
utilsysctl.VmPanicOnOOM: utilsysctl.VmPanicOnOOMInvokeOOMKiller,
utilsysctl.KernelPanic: utilsysctl.KernelPanicRebootTimeout,
utilsysctl.KernelPanicOnOops: utilsysctl.KernelPanicOnOopsAlways,
utilsysctl.RootMaxKeys: utilsysctl.RootMaxKeysSetting,
utilsysctl.RootMaxBytes: utilsysctl.RootMaxBytesSetting,
}

sysctl := utilsysctl.New()
Expand Down
5 changes: 5 additions & 0 deletions pkg/util/sysctl/sysctl.go
View file
Open in desktop
Expand Up @@ -29,12 +29,17 @@ const (
VmPanicOnOOM = "vm/panic_on_oom"
KernelPanic = "kernel/panic"
KernelPanicOnOops = "kernel/panic_on_oops"
RootMaxKeys = "kernel/keys/root_maxkeys"
RootMaxBytes = "kernel/keys/root_maxbytes"

VmOvercommitMemoryAlways = 1 // kernel performs no memory over-commit handling
VmPanicOnOOMInvokeOOMKiller = 0 // kernel calls the oom_killer function when OOM occurs

KernelPanicOnOopsAlways = 1 // kernel panics on kernel oops
KernelPanicRebootTimeout = 10 // seconds after a panic for the kernel to reboot

RootMaxKeysSetting = 1000000 // Needed since docker creates a new key per container
RootMaxBytesSetting = RootMaxKeysSetting * 25 // allocate 25 bytes per key * number of MaxKeys
)

// An injectable interface for running sysctl commands.
Expand Down