runc does not check for the existence of the file generated by cgroup before writing

[KentaTada]

The original issue is https://github.com/kubernetes/kubeadm/issues/2335#issuecomment-716989252

runc does not check for the existence of the file like /sys/fs/cgroup/cpu/cpu.cfs_quota_us before writing the value to that even if the file is generated from the optional kernel configs.
I think runc should output the warning log or just ignore it when those files don't exist.

[cyphar]

We shouldn't be writing to files unless the configuration explicitly requires us to (this would mean that you would have to have a config.json which is explicitly setting resources.cpu.quota to an explicit value). In fact, looking at libcontainers/cgroups/fs/cpu.go this does appear to be the case:

func (s *CpuGroup) Set(path string, cgroup *configs.Cgroup) error {
    // ... snip ...
    if cgroup.Resources.CpuPeriod != 0 {
        if err := fscommon.WriteFile(path, "cpu.cfs_period_us", strconv.FormatUint(cgroup.Resources.CpuPeriod, 10)); err != nil {
            return err
        }
    }
    if cgroup.Resources.CpuQuota != 0 {
        if err := fscommon.WriteFile(path, "cpu.cfs_quota_us", strconv.FormatInt(cgroup.Resources.CpuQuota, 10)); err != nil {
            return err
        }
    }
    return s.SetRtSched(path, cgroup)
}

(Through conversions, cgroup.Resources.CpuQuota != 0 is only true if it was explicitly set in the configuration.)

We simply cannot ignore explicit configuration options because they may be used for security purposes (among other reasons) and so my question is whether Kubernetes is intentionally generating these settings and whether under the proposed kernel configuration Kubernetes should stop adding those settings. Or is something else in the pipeline generating these settings?

[cyphar]

Given that kubadm appears to be moving towards doing auto-detection there, I'll close this. Let me know if you want to re-open it.