Merge pull request #349 from erikwilson/missing-cgroup-pids-fix

Check for cgroup pids support

pkg/daemons/agent/agent.go

@@ -101,17 +101,23 @@ func kubelet(cfg *config.Agent) {
 	if err != nil || defaultIP.String() != cfg.NodeIP {
 		argsMap["node-ip"] = cfg.NodeIP
 	}
-	root, hasCFS := checkCgroups()
+	root, hasCFS, hasPIDs := checkCgroups()
 	if !hasCFS {
 		logrus.Warn("Disabling CPU quotas due to missing cpu.cfs_period_us")
 		argsMap["cpu-cfs-quota"] = "false"
 	}
+	if !hasPIDs {
+		logrus.Warn("Disabling pod PIDs limit feature due to missing cgroup pids support")
+		argsMap["cgroups-per-qos"] = "false"
+		argsMap["enforce-node-allocatable"] = ""
+		argsMap["feature-gates"] = addFeatureGate(argsMap["feature-gates"], "SupportPodPidsLimit=false")
+	}
 	if root != "" {
 		argsMap["runtime-cgroups"] = root
 		argsMap["kubelet-cgroups"] = root
 	}
 	if system.RunningInUserNS() {
-		argsMap["feature-gates"] = "DevicePlugins=false"
+		argsMap["feature-gates"] = addFeatureGate(argsMap["feature-gates"], "DevicePlugins=false")
 	}
 
 	args := config.GetArgsList(argsMap, cfg.ExtraKubeletArgs)
@@ -123,15 +129,20 @@ func kubelet(cfg *config.Agent) {
 	}()
 }
 
-func checkCgroups() (string, bool) {
+func addFeatureGate(current, new string) string {
+	if current == "" {
+		return new
+	}
+	return current + "," + new
+}
+
+func checkCgroups() (root string, hasCFS bool, hasPIDs bool) {
 	f, err := os.Open("/proc/self/cgroup")
 	if err != nil {
-		return "", false
+		return "", false, false
 	}
 	defer f.Close()
 
-	ret := false
-	root := ""
 	scan := bufio.NewScanner(f)
 	for scan.Scan() {
 		parts := strings.Split(scan.Text(), ":")
@@ -140,10 +151,12 @@ func checkCgroups() (string, bool) {
 		}
 		systems := strings.Split(parts[1], ",")
 		for _, system := range systems {
-			if system == "cpu" {
+			if system == "pids" {
+				hasPIDs = true
+			} else if system == "cpu" {
 				p := filepath.Join("/sys/fs/cgroup", parts[1], parts[2], "cpu.cfs_period_us")
 				if _, err := os.Stat(p); err == nil {
-					ret = true
+					hasCFS = true
 				}
 			} else if system == "name=systemd" {
 				last := parts[len(parts)-1]
@@ -155,5 +168,5 @@ func checkCgroups() (string, bool) {
 		}
 	}
 
-	return root, ret
+	return root, hasCFS, hasPIDs
 }

trash.lock

@@ -295,7 +295,7 @@ import:
 - package: k8s.io/klog
   version: v0.2.0-14-g8e90cee79f8237
 - package: k8s.io/kubernetes
-  version: v1.14.1-k3s.3
+  version: v1.14.1-k3s.4
   repo: https://github.com/rancher/k3s.git
   transitive: true
   staging: true

vendor.conf

@@ -9,7 +9,7 @@ package=github.com/opencontainers/runc/libcontainer/nsenter
 package=github.com/opencontainers/runc/libcontainer/specconv
 package=github.com/opencontainers/runc/contrib/cmd/recvtty
 
-k8s.io/kubernetes                   v1.14.1-k3s.3                             https://github.com/rancher/k3s.git                transitive=true,staging=true
+k8s.io/kubernetes                   v1.14.1-k3s.4                             https://github.com/rancher/k3s.git                transitive=true,staging=true
 
 github.com/rancher/norman           50017efee23caa79542ef685b65a7b783e0a73ca  https://github.com/ibuildthecloud/norman.git
 github.com/coreos/flannel           823afe66b2266bf71f5bec24e6e28b26d70cfc7c  https://github.com/ibuildthecloud/flannel.git

vendor/k8s.io/client-go/pkg/version/base.go

@@ -3,8 +3,8 @@ package version
 var (
 	gitMajor = "1"
 	gitMinor = "14"
-	gitVersion   = "v1.14.1-k3s.3"
+	gitVersion   = "v1.14.1-k3s.4"
-	gitCommit    = "4ebc432f987a09a4e215fc530c3aed911922e4b4"
+	gitCommit    = "52f3b42401c93c36467f1fd6d294a3aba26c7def"
 	gitTreeState = "clean"
-	buildDate = "2019-04-11T20:33+00:00Z"
+	buildDate = "2019-04-15T22:13+00:00Z"
 )

vendor/k8s.io/kubernetes/cmd/kube-apiserver/app/server.go

@@ -169,6 +169,7 @@ func CreateServerChain(completedOptions completedServerRunOptions, stopCh <-chan
 
 	if DefaultProxyDialerFn != nil {
 		completedOptions.KubeletConfig.Dial = DefaultProxyDialerFn
+		completedOptions.KubeletConfig.Proxy = http.ProxyURL(nil)
 	}
 
 	kubeAPIServerConfig, insecureServingInfo, serviceResolver, pluginInitializer, admissionPostStartHook, err := CreateKubeAPIServerConfig(completedOptions, proxyTransport)

vendor/k8s.io/kubernetes/pkg/kubelet/client/kubelet_client.go

@@ -19,6 +19,7 @@ package client
 import (
 	"context"
 	"net/http"
+	"net/url"
 	"strconv"
 	"time"
 
@@ -51,6 +52,9 @@ type KubeletClientConfig struct {
 
 	// Dial is a custom dialer used for the client
 	Dial utilnet.DialFunc
+
+	// Proxy is a custom proxy function for the client
+	Proxy func(*http.Request) (*url.URL, error)
 }
 
 // ConnectionInfo provides the information needed to connect to a kubelet
@@ -77,6 +81,7 @@ func MakeTransport(config *KubeletClientConfig) (http.RoundTripper, error) {
 		rt = utilnet.SetOldTransportDefaults(&http.Transport{
 			DialContext:     config.Dial,
 			TLSClientConfig: tlsConfig,
+			Proxy:           config.Proxy,
 		})
 	}
 

vendor/k8s.io/kubernetes/pkg/version/base.go

@@ -3,8 +3,8 @@ package version
 var (
 	gitMajor = "1"
 	gitMinor = "14"
-	gitVersion   = "v1.14.1-k3s.3"
+	gitVersion   = "v1.14.1-k3s.4"
-	gitCommit    = "4ebc432f987a09a4e215fc530c3aed911922e4b4"
+	gitCommit    = "52f3b42401c93c36467f1fd6d294a3aba26c7def"
 	gitTreeState = "clean"
-	buildDate = "2019-04-11T20:33+00:00Z"
+	buildDate = "2019-04-15T22:13+00:00Z"
 )