Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OCPBUGS-30569: Systemd processes not being moved to cpuset/systemd.slice fix #992

Merged

Conversation

rbaturov
Copy link
Contributor

@rbaturov rbaturov commented Mar 14, 2024

The script cpuset-configure.sh is responsible to move the
systemd processes to the cpuset/systemd.slice cgroup and is executed
in a form of a service (cpuset-configure.service).

In the current implementation, the script is executed too early - some
system processes are yet to be created.
This in turn leads to them not being moved to the custom system slice.

Moreover, in the current implementation, the script is executed before
the network-online.target. The intention was to execute the script before
kubelet and crio services are initialized (by the fact network-online.target
is a common parent) in order to make sure that no workload pods are starting
before we are making this transition.

The fix I'm proposing consist of the following changes:

  1. Adding an After statement - The script will start once crio service is initialized,
    due to the fact it's initialized in the very end of the boot process,
    just a bit before kubelet.
    Thereby we can ensure late starting processes do not fall between the cracks.
  2. Narrowing down the Before statement to a more accurate
    one, reflecting its original intention. (Running the script before kubelet
    only would be enough guarantee no workload pods are started at that time).

@openshift-ci-robot openshift-ci-robot added jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. labels Mar 14, 2024
@openshift-ci-robot
Copy link
Contributor

@rbaturov: This pull request references Jira Issue OCPBUGS-30569, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.16.0) matches configured target version for branch (4.16.0)
  • bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (mniranja@redhat.com), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

The script cpuset-configure.sh is responsible to move the systemd processes to the cpuset/systemd.slice cgroup and is executed in a form of a service (cpuset-configure.service).

In the current implementation, the script is executed too early - some system processes are yet to be created.
This in turn leads to them not being moved to the custom system slice.

Moreover, in the current implementation, the script is executed before the network-online.target. The intention was to execute the script before kubelet and crio services are initialized, by the fact network-online.target is a common parent.

The fix I'm proposing consist of the following changes:

  1. Adding an After statements - The script will start once the late starting processes as NetworkManager, sshd, etc... are started. Thereby we can ensure processes as such do not fall between the cracks.
  2. Narrowing down the Before statement to a more accurate one, reflecting its original intention.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@rbaturov
Copy link
Contributor Author

/hold
This is not final, need to rerun render-sync and push updated manifests.

@openshift-ci openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 14, 2024
@openshift-ci openshift-ci bot requested review from jmencak and Tal-or March 14, 2024 16:11
@rbaturov
Copy link
Contributor Author

rbaturov commented Mar 14, 2024

System services boot order without the fix
Screenshot from 2024-03-14 14-17-34
System services boot order with the fix
image

The full plots can be found in the Jira ticket in the comments section.

@rbaturov rbaturov force-pushed the system-processes-not-moved-fix branch from b4c5e0d to a04faf5 Compare March 17, 2024 07:02
@rbaturov
Copy link
Contributor Author

/retest-required

@haircommander
Copy link
Member

general approach LGTM

one question but it doesn't necessarily need to be addressed

@rbaturov
Copy link
Contributor Author

/unhold

@openshift-ci openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 19, 2024
@rbaturov rbaturov force-pushed the system-processes-not-moved-fix branch from ee2a78a to 0e6ef59 Compare March 21, 2024 07:20
@rbaturov rbaturov force-pushed the system-processes-not-moved-fix branch 3 times, most recently from dd90277 to deffc0c Compare March 21, 2024 10:26
@rbaturov
Copy link
Contributor Author

/retest-required

@rbaturov
Copy link
Contributor Author

/hold
Please don't retest.
We have legit errors with this solution.

   [FAILED] The node ci-op-xb6r1606-13bd6-r6bt4-worker-a-fdtrd has the following processes on the root cgroup: [/usr/bin/rpcbind -w -f /usr/sbin/rpc.statd /usr/lib/polkit-1/polkitd --no-debug]
  Expected
      <[]string | len:3, cap:3>: [
          "/usr/bin/rpcbind -w -f",
          "/usr/sbin/rpc.statd",
          "/usr/lib/polkit-1/polkitd --no-debug",
      ]
  to be empty
  In [It] at: /go/src/github.com/openshift/cluster-node-tuning-operator/test/e2e/performanceprofile/functests/1_performance/performance.go:304 @ 03/24/24 20:34:35.789

@openshift-ci openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 25, 2024
@rbaturov rbaturov force-pushed the system-processes-not-moved-fix branch from deffc0c to 1c0a391 Compare March 25, 2024 11:50
@openshift-ci-robot
Copy link
Contributor

@rbaturov: This pull request references Jira Issue OCPBUGS-30569, which is valid.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.16.0) matches configured target version for branch (4.16.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (mniranja@redhat.com), skipping review request.

In response to this:

The script cpuset-configure.sh is responsible to move the
systemd processes to the cpuset/systemd.slice cgroup and is executed
in a form of a service (cpuset-configure.service).

In the current implementation, the script is executed too early - some
system processes are yet to be created.
This in turn leads to them not being moved to the custom system slice.

Moreover, in the current implementation, the script is executed before
the network-online.target. The intention was to execute the script before
kubelet and crio services are initialized (by the fact network-online.target
is a common parent) in order to make sure that no workload pods are starting
before we are making this transition.

The fix I'm proposing consist of the following changes:

  1. Adding an After statement - The script will start once crio service is initialized,
    due to the fact it's initialized in the very end of the boot process,
    just a bit before kubelet.
    Thereby we can ensure late starting processes do not fall between the cracks.
  2. Narrowing down the Before statement to a more accurate
    one, reflecting its original intention. (Running the script before kubelet
    only would be enough guarantee no workload pods are started at that time).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@rbaturov
Copy link
Contributor Author

/retest-required

The script cpuset-configure.sh is responsible to move the
systemd processes to the cpuset/systemd.slice cgroup and  is executed
in a form of a service (cpuset-configure.service).

In the current implementation, the script is executed too early - some
system processes are yet to be created.
This in turn leads to them not being moved to the custom system slice.

Moreover, in the current implementation, the script is executed before
the network-online.target. The intention was to execute the script before
kubelet and crio services are initialized (by the fact network-online.target
is a common parent) in order to make sure that no workload pods are starting
before we are making this transition.

The fix I'm proposing consist of the following changes:
1. Adding an After statements - The script will start once crio service is initialized,
due to the fact it's initialized in the very end of the boot process,
just a bit before kubelet.
Thereby we can ensure late starting processes do not fall between the cracks.
2. Narrowing down the Before statement to a more accurate
one, reflecting its original intention. (Running the script before kubelet
only would be enough guarantee no workload pods are started at that time).

Signed-off-by: Ronny Baturov <rbaturov@redhat.com>
When we are using cgroups v1 we are counting on the cpuset-configure.service
to move all the system services to the custom system.slice.
This test ensures the service indeed moved them.

It is also a good practice to check for similar errors on cgroup v2 systems.

Signed-off-by: Ronny Baturov <rbaturov@redhat.com>
@rbaturov rbaturov force-pushed the system-processes-not-moved-fix branch from 1c0a391 to 809bebf Compare March 27, 2024 18:18
@rbaturov
Copy link
Contributor Author

/retest-required

@rbaturov
Copy link
Contributor Author

/unhold

@openshift-ci openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 28, 2024
@yanirq
Copy link
Contributor

yanirq commented Apr 1, 2024

/lgtm

@MarSik PTAL for another review

@openshift-ci openshift-ci bot requested a review from MarSik April 1, 2024 14:50
Copy link
Contributor

openshift-ci bot commented Apr 1, 2024

@yanirq: GitHub didn't allow me to request PR reviews from the following users: PTAL, for, another, review.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to this:

/lgtm

/cc @MarSik PTAL for another review

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Apr 1, 2024
@ffromani
Copy link
Contributor

ffromani commented Apr 3, 2024

/approve

the test seems ok - as simple as can be, and the dependency logic seems to be the sweet spot

Copy link
Contributor

openshift-ci bot commented Apr 3, 2024

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ffromani, rbaturov

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 3, 2024
@openshift-ci-robot
Copy link
Contributor

/retest-required

Remaining retests: 0 against base HEAD 1bb1dcc and 2 for PR HEAD 809bebf in total

Copy link
Contributor

openshift-ci bot commented Apr 3, 2024

@rbaturov: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@openshift-merge-bot openshift-merge-bot bot merged commit 89b3e39 into openshift:master Apr 3, 2024
16 checks passed
@openshift-ci-robot
Copy link
Contributor

@rbaturov: Jira Issue OCPBUGS-30569: All pull requests linked via external trackers have merged:

Jira Issue OCPBUGS-30569 has been moved to the MODIFIED state.

In response to this:

The script cpuset-configure.sh is responsible to move the
systemd processes to the cpuset/systemd.slice cgroup and is executed
in a form of a service (cpuset-configure.service).

In the current implementation, the script is executed too early - some
system processes are yet to be created.
This in turn leads to them not being moved to the custom system slice.

Moreover, in the current implementation, the script is executed before
the network-online.target. The intention was to execute the script before
kubelet and crio services are initialized (by the fact network-online.target
is a common parent) in order to make sure that no workload pods are starting
before we are making this transition.

The fix I'm proposing consist of the following changes:

  1. Adding an After statement - The script will start once crio service is initialized,
    due to the fact it's initialized in the very end of the boot process,
    just a bit before kubelet.
    Thereby we can ensure late starting processes do not fall between the cracks.
  2. Narrowing down the Before statement to a more accurate
    one, reflecting its original intention. (Running the script before kubelet
    only would be enough guarantee no workload pods are started at that time).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@rbaturov
Copy link
Contributor Author

rbaturov commented Apr 3, 2024

/cherry-pick release-4.15

@openshift-cherrypick-robot

@rbaturov: #992 failed to apply on top of branch "release-4.15":

Applying: Systemd processes not being moved to cpuset/systemd.slice fix
Using index info to reconstruct a base tree...
A	test/e2e/performanceprofile/testdata/render-expected-output/bootstrap/extra-ctrcfg/openshift-bootstrap-master_machineconfig.yaml
A	test/e2e/performanceprofile/testdata/render-expected-output/bootstrap/extra-ctrcfg/openshift-bootstrap-worker_machineconfig.yaml
M	test/e2e/performanceprofile/testdata/render-expected-output/bootstrap/extra-mcp/openshift-bootstrap-master_machineconfig.yaml
M	test/e2e/performanceprofile/testdata/render-expected-output/bootstrap/extra-mcp/openshift-bootstrap-worker_machineconfig.yaml
M	test/e2e/performanceprofile/testdata/render-expected-output/bootstrap/no-mcp/openshift-bootstrap-master_machineconfig.yaml
M	test/e2e/performanceprofile/testdata/render-expected-output/bootstrap/no-mcp/openshift-bootstrap-worker_machineconfig.yaml
A	test/e2e/performanceprofile/testdata/render-expected-output/default/cpuFrequency/manual_machineconfig.yaml
M	test/e2e/performanceprofile/testdata/render-expected-output/default/manual_machineconfig.yaml
Falling back to patching base and 3-way merge...
Auto-merging test/e2e/performanceprofile/testdata/render-expected-output/default/manual_machineconfig.yaml
CONFLICT (modify/delete): test/e2e/performanceprofile/testdata/render-expected-output/default/cpuFrequency/manual_machineconfig.yaml deleted in HEAD and modified in Systemd processes not being moved to cpuset/systemd.slice fix. Version Systemd processes not being moved to cpuset/systemd.slice fix of test/e2e/performanceprofile/testdata/render-expected-output/default/cpuFrequency/manual_machineconfig.yaml left in tree.
Auto-merging test/e2e/performanceprofile/testdata/render-expected-output/bootstrap/no-mcp/openshift-bootstrap-worker_machineconfig.yaml
Auto-merging test/e2e/performanceprofile/testdata/render-expected-output/bootstrap/no-mcp/openshift-bootstrap-master_machineconfig.yaml
Auto-merging test/e2e/performanceprofile/testdata/render-expected-output/bootstrap/extra-mcp/openshift-bootstrap-worker_machineconfig.yaml
Auto-merging test/e2e/performanceprofile/testdata/render-expected-output/bootstrap/extra-mcp/openshift-bootstrap-master_machineconfig.yaml
CONFLICT (modify/delete): test/e2e/performanceprofile/testdata/render-expected-output/bootstrap/extra-ctrcfg/openshift-bootstrap-worker_machineconfig.yaml deleted in HEAD and modified in Systemd processes not being moved to cpuset/systemd.slice fix. Version Systemd processes not being moved to cpuset/systemd.slice fix of test/e2e/performanceprofile/testdata/render-expected-output/bootstrap/extra-ctrcfg/openshift-bootstrap-worker_machineconfig.yaml left in tree.
CONFLICT (modify/delete): test/e2e/performanceprofile/testdata/render-expected-output/bootstrap/extra-ctrcfg/openshift-bootstrap-master_machineconfig.yaml deleted in HEAD and modified in Systemd processes not being moved to cpuset/systemd.slice fix. Version Systemd processes not being moved to cpuset/systemd.slice fix of test/e2e/performanceprofile/testdata/render-expected-output/bootstrap/extra-ctrcfg/openshift-bootstrap-master_machineconfig.yaml left in tree.
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 Systemd processes not being moved to cpuset/systemd.slice fix
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

/cherry-pick release-4.15

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

rbaturov added a commit to rbaturov/cluster-node-tuning-operator that referenced this pull request Apr 3, 2024
…/systemd.slice fix

This is a manual backport for openshift#992

* Systemd processes not being moved to cpuset/systemd.slice fix

The script cpuset-configure.sh is responsible to move the
systemd processes to the cpuset/systemd.slice cgroup and  is executed
in a form of a service (cpuset-configure.service).

In the current implementation, the script is executed too early - some
system processes are yet to be created.
This in turn leads to them not being moved to the custom system slice.

Moreover, in the current implementation, the script is executed before
the network-online.target. The intention was to execute the script before
kubelet and crio services are initialized (by the fact network-online.target
is a common parent) in order to make sure that no workload pods are starting
before we are making this transition.

The fix I'm proposing consist of the following changes:
1. Adding an After statements - The script will start once crio service is initialized,
due to the fact it's initialized in the very end of the boot process,
just a bit before kubelet.
Thereby we can ensure late starting processes do not fall between the cracks.
2. Narrowing down the Before statement to a more accurate
one, reflecting its original intention. (Running the script before kubelet
only would be enough guarantee no workload pods are started at that time).

Signed-off-by: Ronny Baturov <rbaturov@redhat.com>

* Added a test to verify system processes are in the correct cgroup

When we are using cgroups v1 we are counting on the cpuset-configure.service
to move all the system services to the custom system.slice.
This test ensures the service indeed moved them.

It is also a good practice to check for similar errors on cgroup v2 systems.

Signed-off-by: Ronny Baturov <rbaturov@redhat.com>

---------

Signed-off-by: Ronny Baturov <rbaturov@redhat.com>
rbaturov added a commit to rbaturov/cluster-node-tuning-operator that referenced this pull request Apr 3, 2024
This is a manual backport for openshift#992

* Systemd processes not being moved to cpuset/systemd.slice fix

The script cpuset-configure.sh is responsible to move the
systemd processes to the cpuset/systemd.slice cgroup and  is executed
in a form of a service (cpuset-configure.service).

In the current implementation, the script is executed too early - some
system processes are yet to be created.
This in turn leads to them not being moved to the custom system slice.

Moreover, in the current implementation, the script is executed before
the network-online.target. The intention was to execute the script before
kubelet and crio services are initialized (by the fact network-online.target
is a common parent) in order to make sure that no workload pods are starting
before we are making this transition.

The fix I'm proposing consist of the following changes:
1. Adding an After statements - The script will start once crio service is initialized,
due to the fact it's initialized in the very end of the boot process,
just a bit before kubelet.
Thereby we can ensure late starting processes do not fall between the cracks.
2. Narrowing down the Before statement to a more accurate
one, reflecting its original intention. (Running the script before kubelet
only would be enough guarantee no workload pods are started at that time).

Signed-off-by: Ronny Baturov <rbaturov@redhat.com>

* Added a test to verify system processes are in the correct cgroup

When we are using cgroups v1 we are counting on the cpuset-configure.service
to move all the system services to the custom system.slice.
This test ensures the service indeed moved them.

It is also a good practice to check for similar errors on cgroup v2 systems.

Signed-off-by: Ronny Baturov <rbaturov@redhat.com>

---------

Signed-off-by: Ronny Baturov <rbaturov@redhat.com>
rbaturov added a commit to rbaturov/cluster-node-tuning-operator that referenced this pull request Apr 3, 2024
This is a manual backport for openshift#992

* Systemd processes not being moved to cpuset/systemd.slice fix

The script cpuset-configure.sh is responsible to move the
systemd processes to the cpuset/systemd.slice cgroup and  is executed
in a form of a service (cpuset-configure.service).

In the current implementation, the script is executed too early - some
system processes are yet to be created.
This in turn leads to them not being moved to the custom system slice.

Moreover, in the current implementation, the script is executed before
the network-online.target. The intention was to execute the script before
kubelet and crio services are initialized (by the fact network-online.target
is a common parent) in order to make sure that no workload pods are starting
before we are making this transition.

The fix I'm proposing consist of the following changes:
1. Adding an After statements - The script will start once crio service is initialized,
due to the fact it's initialized in the very end of the boot process,
just a bit before kubelet.
Thereby we can ensure late starting processes do not fall between the cracks.
2. Narrowing down the Before statement to a more accurate
one, reflecting its original intention. (Running the script before kubelet
only would be enough guarantee no workload pods are started at that time).

Signed-off-by: Ronny Baturov <rbaturov@redhat.com>

* Added a test to verify system processes are in the correct cgroup

When we are using cgroups v1 we are counting on the cpuset-configure.service
to move all the system services to the custom system.slice.
This test ensures the service indeed moved them.

It is also a good practice to check for similar errors on cgroup v2 systems.

Signed-off-by: Ronny Baturov <rbaturov@redhat.com>

---------

Signed-off-by: Ronny Baturov <rbaturov@redhat.com>
rbaturov added a commit to rbaturov/cluster-node-tuning-operator that referenced this pull request Apr 3, 2024
This is a manual backport for openshift#992

* Systemd processes not being moved to cpuset/systemd.slice fix

The script cpuset-configure.sh is responsible to move the
systemd processes to the cpuset/systemd.slice cgroup and  is executed
in a form of a service (cpuset-configure.service).

In the current implementation, the script is executed too early - some
system processes are yet to be created.
This in turn leads to them not being moved to the custom system slice.

Moreover, in the current implementation, the script is executed before
the network-online.target. The intention was to execute the script before
kubelet and crio services are initialized (by the fact network-online.target
is a common parent) in order to make sure that no workload pods are starting
before we are making this transition.

The fix I'm proposing consist of the following changes:
1. Adding an After statements - The script will start once crio service is initialized,
due to the fact it's initialized in the very end of the boot process,
just a bit before kubelet.
Thereby we can ensure late starting processes do not fall between the cracks.
2. Narrowing down the Before statement to a more accurate
one, reflecting its original intention. (Running the script before kubelet
only would be enough guarantee no workload pods are started at that time).

Signed-off-by: Ronny Baturov <rbaturov@redhat.com>

* Added a test to verify system processes are in the correct cgroup

When we are using cgroups v1 we are counting on the cpuset-configure.service
to move all the system services to the custom system.slice.
This test ensures the service indeed moved them.

It is also a good practice to check for similar errors on cgroup v2 systems.

Signed-off-by: Ronny Baturov <rbaturov@redhat.com>

---------

Signed-off-by: Ronny Baturov <rbaturov@redhat.com>
@openshift-bot
Copy link
Contributor

[ART PR BUILD NOTIFIER]

This PR has been included in build cluster-node-tuning-operator-container-v4.16.0-202404031748.p0.g89b3e39.assembly.stream.el9 for distgit cluster-node-tuning-operator.
All builds following this will include this PR.

rbaturov added a commit to rbaturov/cluster-node-tuning-operator that referenced this pull request Apr 7, 2024
This is a manual backport for openshift#992

* Systemd processes not being moved to cpuset/systemd.slice fix

The script cpuset-configure.sh is responsible to move the
systemd processes to the cpuset/systemd.slice cgroup and  is executed
in a form of a service (cpuset-configure.service).

In the current implementation, the script is executed too early - some
system processes are yet to be created.
This in turn leads to them not being moved to the custom system slice.

Moreover, in the current implementation, the script is executed before
the network-online.target. The intention was to execute the script before
kubelet and crio services are initialized (by the fact network-online.target
is a common parent) in order to make sure that no workload pods are starting
before we are making this transition.

The fix I'm proposing consist of the following changes:
1. Adding an After statements - The script will start once crio service is initialized,
due to the fact it's initialized in the very end of the boot process,
just a bit before kubelet.
Thereby we can ensure late starting processes do not fall between the cracks.
2. Narrowing down the Before statement to a more accurate
one, reflecting its original intention. (Running the script before kubelet
only would be enough guarantee no workload pods are started at that time).

Signed-off-by: Ronny Baturov <rbaturov@redhat.com>

* Added a test to verify system processes are in the correct cgroup

When we are using cgroups v1 we are counting on the cpuset-configure.service
to move all the system services to the custom system.slice.
This test ensures the service indeed moved them.

It is also a good practice to check for similar errors on cgroup v2 systems.

Signed-off-by: Ronny Baturov <rbaturov@redhat.com>

---------

Signed-off-by: Ronny Baturov <rbaturov@redhat.com>
openshift-merge-bot bot pushed a commit that referenced this pull request Apr 8, 2024
This is a manual backport for #992

* Systemd processes not being moved to cpuset/systemd.slice fix

The script cpuset-configure.sh is responsible to move the
systemd processes to the cpuset/systemd.slice cgroup and  is executed
in a form of a service (cpuset-configure.service).

In the current implementation, the script is executed too early - some
system processes are yet to be created.
This in turn leads to them not being moved to the custom system slice.

Moreover, in the current implementation, the script is executed before
the network-online.target. The intention was to execute the script before
kubelet and crio services are initialized (by the fact network-online.target
is a common parent) in order to make sure that no workload pods are starting
before we are making this transition.

The fix I'm proposing consist of the following changes:
1. Adding an After statements - The script will start once crio service is initialized,
due to the fact it's initialized in the very end of the boot process,
just a bit before kubelet.
Thereby we can ensure late starting processes do not fall between the cracks.
2. Narrowing down the Before statement to a more accurate
one, reflecting its original intention. (Running the script before kubelet
only would be enough guarantee no workload pods are started at that time).



* Added a test to verify system processes are in the correct cgroup

When we are using cgroups v1 we are counting on the cpuset-configure.service
to move all the system services to the custom system.slice.
This test ensures the service indeed moved them.

It is also a good practice to check for similar errors on cgroup v2 systems.



---------

Signed-off-by: Ronny Baturov <rbaturov@redhat.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

7 participants