Promote PidLimits to GA

[derekwaynecarr]

What type of PR is this?
/kind feature

What this PR does / why we need it:
Promotes pid limiting features to GA after being enabled and on-by-default for a year.

Special notes for your reviewer:
There have been no known issues with the feature, and its been enabled for over a year by default.

Does this PR introduce a user-facing change?:

Promote SupportNodePidsLimit to GA to provide node to pod pid isolation
Promote SupportPodPidsLimit to GA to provide ability to limit pids per pod

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

- [KEP]: https://github.com/kubernetes/enhancements/pull/1952

[derekwaynecarr]

/assign @dashpole @dchen1107 @sjenning @liggitt

[dashpole]

/lgtm

[dashpole]

/kind feature
/priority important-longterm

[liggitt]

do the feature tags need to be removed from node tests like SIGDescribe("PodPidsLimit [Serial] [Feature:SupportPodPidsLimit][NodeFeature:SupportPodPidsLimit]" now that this is unconditionally enabled?

should the pids cgroup be moved out of the CgroupsOptional / CgroupsV2Optional now that these features are always enabled?

	Cgroups: []string{"cpu", "cpuacct", "cpuset", "devices", "freezer", "memory"},
	CgroupsOptional: []string{
		// The hugetlb cgroup is optional since some kernels are compiled without support for huge pages
		// and therefore lacks corresponding hugetlb cgroup
		"hugetlb",
		// The pids cgroup is optional since it is only used when at least one of the feature flags "SupportPodPidsLimit" and
		// "SupportNodePidsLimit" is enabled
		"pids",
	},
	CgroupsV2:         []string{"cpu", "cpuset", "devices", "freezer", "memory"},
	CgroupsV2Optional: []string{"hugetlb", "pids"},

[derekwaynecarr]

thanks @liggitt , i was not sure if we removed the internal references to the gate in the subsequent release. will update the pr.

[SergeyKanzhelev]

follow up: kubernetes/system-validators#18

system-validators are in vendor folder. I don't think there is a rush to update it though

[SergeyKanzhelev]

/kind feature

[SergeyKanzhelev]

/remove needs-kind

[dims]

/kind feature
/approve
/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: derekwaynecarr, dims

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• cmd/kubelet/OWNERS [derekwaynecarr]
• pkg/features/OWNERS [derekwaynecarr,dims]
• pkg/kubelet/cm/OWNERS [derekwaynecarr]
• test/e2e_node/OWNERS [derekwaynecarr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[nikhita]

removing and re-adding kind/feature to make the bot remove needs-kind

/remove-kind feature

[nikhita]

/kind feature

[neolit123]

/retest

GCR pull flake in pull-kubernetes-conformance-kind-ga-only-parallel.

[tengqm]

This needs docs.

[SergeyKanzhelev]

This needs docs.

There is a little bit of docs:

https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/#options:~:text=%2D%2Dpod%2Dmax%2Dpids%20int

And config doc page points to here:

kubernetes/staging/src/k8s.io/kubelet/config/v1beta1/types.go

Lines 484 to 490 in f5a54e3

	// PodPidsLimit is the maximum number of pids in any pod.
	// Requires the SupportPodPidsLimit feature gate to be enabled.
	// Dynamic Kubelet Config (beta): If dynamically updating this field, consider that
	// lowering it may prevent container processes from forking after the change.
	// Default: -1
	// +optional
	PodPidsLimit *int64 `json:"podPidsLimit,omitempty"`

What kind of docs do you have in mind?

[sftim]

@SergeyKanzhelev I suggest:
add a new page inside https://kubernetes.io/docs/concepts/policy/ about limiting PID use for pods and nodes, and have https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ link to that new page.

[SergeyKanzhelev]

@SergeyKanzhelev I suggest:
add a new page inside https://kubernetes.io/docs/concepts/policy/ about limiting PID use for pods and nodes, and have https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ link to that new page.

@sftim PTAL kubernetes/website#23929

[zoujili]

@derekwaynecarr

My os version is Linux h07c09304.sqa.eu95 3.10.0-327.ali2008.alios7.x86_64
kublet met error as below:

Failed to start ContainerManager failed to initialize top level QOS containers: failed to update top level Burstable QOS cgroup : failed to set supported cgroup subsystems for cgroup kubepods burstable]: failed to find subsystem mount for required subsystem: pids
what can i do for this without upgrade the kernel？

thanks for reply

[SergeyKanzhelev]

@zoujili I suggest to file a separate issue instead of commenting in the merged PR.