Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add kubelet pod pid limit #1527

Merged
merged 1 commit into from Sep 26, 2022
Merged

Add kubelet pod pid limit #1527

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 4 additions & 0 deletions apis/kubekey/v1alpha2/default.go
View file
Open in desktop
Expand Up @@ -57,6 +57,7 @@ const (
DefaultRegistryVersion = "2"
DefaultHarborVersion = "v2.5.3"
DefaultMaxPods = 110
DefaultPodPidsLimit = 10000
DefaultNodeCidrMaskSize = 24
DefaultIPIPMode = "Always"
DefaultVXLANMode = "Never"
Expand Down Expand Up @@ -124,6 +125,9 @@ func (cfg *ClusterSpec) SetDefaultClusterSpec(incluster bool) (*ClusterSpec, map
if cfg.Kubernetes.MaxPods == 0 {
clusterCfg.Kubernetes.MaxPods = DefaultMaxPods
}
if cfg.Kubernetes.PodPidsLimit == 0 {
clusterCfg.Kubernetes.PodPidsLimit = DefaultPodPidsLimit
}
if cfg.Kubernetes.NodeCidrMaskSize == 0 {
clusterCfg.Kubernetes.NodeCidrMaskSize = DefaultNodeCidrMaskSize
}
Expand Down
1 change: 1 addition & 0 deletions apis/kubekey/v1alpha2/kubernetes_types.go
View file
Open in desktop
Expand Up @@ -27,6 +27,7 @@ type Kubernetes struct {
DisableKubeProxy bool `yaml:"disableKubeProxy" json:"disableKubeProxy,omitempty"`
MasqueradeAll bool `yaml:"masqueradeAll" json:"masqueradeAll,omitempty"`
MaxPods int `yaml:"maxPods" json:"maxPods,omitempty"`
PodPidsLimit int `yaml:"podPidsLimit" json:"podPidsLimit,omitempty"`
NodeCidrMaskSize int `yaml:"nodeCidrMaskSize" json:"nodeCidrMaskSize,omitempty"`
ApiserverCertExtraSans []string `yaml:"apiserverCertExtraSans" json:"apiserverCertExtraSans,omitempty"`
ProxyMode string `yaml:"proxyMode" json:"proxyMode,omitempty"`
Expand Down
1 change: 1 addition & 0 deletions docs/config-example.md
View file
Open in desktop
Expand Up @@ -36,6 +36,7 @@ spec:
autoRenewCerts: true # Whether to install a script which can automatically renew the Kubernetes control plane certificates. [Default: false]
masqueradeAll: false # masqueradeAll tells kube-proxy to SNAT everything if using the pure iptables proxy mode. [Default: false].
maxPods: 110 # maxPods is the number of Pods that can run on this Kubelet. [Default: 110]
podPidsLimit: 10000 # podPidsLimit is the maximum number of PIDs in any pod. [Default: 10000]
nodeCidrMaskSize: 24 # The internal network node size allocation. This is the size allocated to each node on your network. [Default: 24]
proxyMode: ipvs # Specify which proxy mode to use. [Default: ipvs]
featureGates: # enable featureGates, [Default: {"ExpandCSIVolumes":true,"RotateKubeletServerCertificate": true,"CSIStorageCapacity":true, "TTLAfterFinished":true}]
Expand Down
5 changes: 4 additions & 1 deletion pkg/kubernetes/templates/v1beta2/kubeadm_config.go
View file
Open in desktop
Expand Up @@ -157,12 +157,14 @@ var (
"TTLAfterFinished": true, //k8s 1.12+
"ExpandCSIVolumes": true, //k8s 1.14+
"CSIStorageCapacity": true, //k8s 1.19+
"SupportPodPidsLimit": true,
}
FeatureGatesSecurityDefaultConfiguration = map[string]bool{
"RotateKubeletServerCertificate": true, //k8s 1.7+
"TTLAfterFinished": true, //k8s 1.12+
"ExpandCSIVolumes": true, //k8s 1.14+
"CSIStorageCapacity": true, //k8s 1.19+
"SupportPodPidsLimit": true,
"SeccompDefault": true, //kubelet
}

Expand Down Expand Up @@ -263,6 +265,7 @@ func GetKubeletConfiguration(runtime connector.Runtime, kubeConf *common.KubeCon
"clusterDomain": kubeConf.Cluster.Kubernetes.DNSDomain,
"clusterDNS": []string{kubeConf.Cluster.ClusterDNS()},
"maxPods": kubeConf.Cluster.Kubernetes.MaxPods,
"podPidsLimit": kubeConf.Cluster.Kubernetes.PodPidsLimit,
"rotateCertificates": true,
"kubeReserved": map[string]string{
"cpu": "200m",
Expand All @@ -274,7 +277,7 @@ func GetKubeletConfiguration(runtime connector.Runtime, kubeConf *common.KubeCon
},
"evictionHard": map[string]string{
"memory.available": "5%",
"pid.available": "5%",
"pid.available": "10%",
},
"evictionSoft": map[string]string{
"memory.available": "10%",
Expand Down