github/k3s - k3s - https://git.xinac.net

2739 Commits

30 Branches

851 Tags

628 MiB

Tree: 9ec1789c21

Commit Graph

Author	SHA1	Message	Date
Akihiro Suda	daf527ccaf	k3s-rootless.service: use fuse-overlayfs snapshotter Kernel 5.11 added support for rootless overlayfs, but still incompatible with SELinux, so we should always use fuse-overlayfs. Related: moby/moby issue 42333 Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>	4 years ago
Akihiro Suda	6e8284e3d4	rootless: enable resource limitation (requires cgroup v2, systemd) Now rootless mode can be used with cgroup v2 resource limitations. A pod is executed in a cgroup like "/user.slice/user-1001.slice/user@1001.service/k3s-rootless.service/kubepods/podd0eb6921-c81a-4214-b36c-d3b9bb212fac/63b5a253a1fd4627da16bfce9bec58d72144cf30fe833e0ca9a6d60ebf837475". This is accomplished by running `kubelet` in a cgroup namespace, and enabling `cgroupfs` driver for the cgroup hierarchy delegated by systemd. To enable cgroup v2 resource limitation, `k3s server --rootless` needs to be launched as `systemctl --user` service. Please see the comment lines in `k3s-rootless.service` for the usage. Running `k3s server --rootless` via a terminal is not supported. When it really needs to be launched via a terminal, `systemd-run --user -p Delegate --tty` needs to be prepended to create a systemd scope. Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>	4 years ago

Author

SHA1

Message

Date

Akihiro Suda

daf527ccaf

k3s-rootless.service: use fuse-overlayfs snapshotter

Kernel 5.11 added support for rootless overlayfs, but still incompatible
with SELinux, so we should always use fuse-overlayfs.

Related: moby/moby issue 42333

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

4 years ago

Akihiro Suda

6e8284e3d4

rootless: enable resource limitation (requires cgroup v2, systemd)

Now rootless mode can be used with cgroup v2 resource limitations.
A pod is executed in a cgroup like "/user.slice/user-1001.slice/user@1001.service/k3s-rootless.service/kubepods/podd0eb6921-c81a-4214-b36c-d3b9bb212fac/63b5a253a1fd4627da16bfce9bec58d72144cf30fe833e0ca9a6d60ebf837475".

This is accomplished by running `kubelet` in a cgroup namespace, and enabling `cgroupfs` driver for the cgroup hierarchy delegated by systemd.

To enable cgroup v2 resource limitation, `k3s server --rootless` needs to be launched as `systemctl --user` service.
Please see the comment lines in `k3s-rootless.service` for the usage.

Running `k3s server --rootless` via a terminal is not supported.
When it really needs to be launched via a terminal, `systemd-run --user -p Delegate --tty` needs to be prepended to create a systemd scope.

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

4 years ago

2 Commits (9ec1789c21f4a38694a3a7b855e2f1da6895cce1)