Runtime: Kata containers cannot support static QoS class.

[mcastelino]

Description of problem

When a cluster is setup with cpuManagerPolicy: static for example with a kubeadm.yaml

apiVersion: kubeadm.k8s.io/v1alpha3
kind: InitConfiguration
nodeRegistration:
  criSocket: /var/run/crio/crio.sock
---
apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
featureGates:
  RuntimeClass: true
cpuManagerPolicy: static
systemReserved:
  cpu: 500m
  memory: 256M
kubeReserved:
  cpu: 500m
  memory: 256M
---
apiVersion: kubeadm.k8s.io/v1alpha3
kind: ClusterConfiguration
networking:
  dnsDomain: cluster.local
  podSubnet: 10.244.0.0/16
  serviceSubnet: 10.96.0.0/12
apiServerExtraArgs:
  feature-gates: RuntimeClass=true

POD creation fails for pods with the runtime class set to Kata with the error

Internal PreStartContainer hook failed: updating resources for container "php-apache" failed: Container php-apache is not running

Expected result

POD creation should work.

Actual result

POD creation fails

[mcastelino]

https://github.com/clearlinux/cloud-native-setup/tree/master/clr-k8s-examples can be used to expose this error with

kubectl apply -f tests/test-deploy-kata.yaml

[krsna1729]

@mcastelino @egernst duplicate of #878 ?

[egernst]

Yes. @mcastelino ok if we close this and work off of #878?

[egernst]

Well -- I actually didn't see it fail before - I just saw it not honored. @mcastelino do you have any logs in journal for this? /cc @jcvenegas

[mythi]

I've ran into this before. My log is:

 Error: failed to create containerd task: OCI runtime create failed: rpc error: code = Internal desc = Could not run process: container_linux.go:348: starting container process caused "process_linux.go:279: applying cgroup configuration for process caused \"failed to write 0-47 to cpuset.cpus: write /sys/fs/cgroup/cpuset/kubepods/burstable/pod25e103bb-0f80-11e9-b6c0-c81f66f6420d/haproxy-ingress/cpuset.cpus: invalid argument\"": unknown

(I'm not with Clear Linux this time though)

[krsna1729]

@egernst https://slack-files.com/T86U7NQTT-FF5UA8YBU-2df3ee321b
This is for guaranteed pod test-cpumanager-kata.yaml

k8s describe has this

Warning  Failed     17s   kubelet, clr-01    Internal PreStartContainer hook failed: updating resources for container "taskset" failed: Container taskset is not running
  (exit status 1)

best-effort logs look slightly different but with same error of container not running.

[jcvenegas]

I took a look to the kata logs and see that when static manager is enabled, there is kata-runtime update CID before the container is started, I added extra steps to allow this, update is not an a standard OCI command so lets allow as runc may allow as well.

[egernst]

@jcvenegas, I saw this before. We check to make sure it is in running state when handling update command. That’s not correct - we should just make sure it is at least created.