From: Adam King Date: Mon, 18 Apr 2022 14:07:18 +0000 (-0400) Subject: Revert "cephadm: remove containers pids-limit" X-Git-Tag: v17.2.0~1^2 X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=4a294cac2f2cf9edd199f7cd81fd6c1ffcb9f4bb;p=ceph.git Revert "cephadm: remove containers pids-limit" This reverts commit 7c1214f38091dde0ba2c5e0557dcd98f97f91302. Signed-off-by: Adam King --- diff --git a/qa/suites/orch/cephadm/workunits/task/test_iscsi_pids_limit.yaml b/qa/suites/orch/cephadm/workunits/task/test_iscsi_pids_limit.yaml deleted file mode 100644 index b271777e1874..000000000000 --- a/qa/suites/orch/cephadm/workunits/task/test_iscsi_pids_limit.yaml +++ /dev/null @@ -1,20 +0,0 @@ -roles: -- - host.a - - osd.0 - - osd.1 - - osd.2 - - mon.a - - mgr.a - - client.0 -tasks: -- install: -- cephadm: -- cephadm.shell: - host.a: - - ceph osd pool create foo - - rbd pool init foo - - ceph orch apply iscsi foo u p -- workunit: - clients: - client.0: - - cephadm/test_iscsi_pids_limit.sh diff --git a/qa/workunits/cephadm/test_iscsi_pids_limit.sh b/qa/workunits/cephadm/test_iscsi_pids_limit.sh deleted file mode 100755 index 32326f140f2f..000000000000 --- a/qa/workunits/cephadm/test_iscsi_pids_limit.sh +++ /dev/null @@ -1,24 +0,0 @@ -#!/bin/bash - -# checks if the containers default pids-limit (4096) is removed and Iscsi -# containers continue to run -# exits 1 if fails - -set -ex - -ISCSI_CONT_IDS=$(sudo podman ps -qa --filter='name=iscsi') -CONT_COUNT=$(echo ${ISCSI_CONT_IDS} | wc -w) -test ${CONT_COUNT} -eq 2 - -for i in ${ISCSI_CONT_IDS} -do - sudo podman exec ${i} /bin/sh -c 'for j in {0..20000}; do sleep 30 & done' -done - -for i in ${ISCSI_CONT_IDS} -do - SLEEP_COUNT=$(sudo podman exec ${i} /bin/sh -c 'ps -ef | grep -c sleep') - test ${SLEEP_COUNT} -gt 20000 -done - -echo OK diff --git a/src/cephadm/cephadm b/src/cephadm/cephadm index ebcd82457763..ca64ae472e37 100755 --- a/src/cephadm/cephadm +++ b/src/cephadm/cephadm @@ -787,10 +787,6 @@ class CephIscsi(object): # remove extra container args for tcmu container. # extra args could cause issue with forking service type tcmu_container.container_args = [] - # set container limits to unlimited as defaults (Docker 4096 / Podman 2048) - # prevents the creation of max lun (default 255) - pids_unlimited = '-1' if isinstance(self.ctx.container_engine, Podman) else '0' - tcmu_container.container_args.extend(['--pids-limit=%s' % pids_unlimited]) return tcmu_container ################################## @@ -2727,8 +2723,6 @@ def get_container(ctx: CephadmContext, envs.extend(Keepalived.get_container_envs()) container_args.extend(['--cap-add=NET_ADMIN', '--cap-add=NET_RAW']) elif daemon_type == CephIscsi.daemon_type: - # Applies only on rbd-target-api as get_tcmu_runner_container() - # removes all tcmu-runner arguments entrypoint = CephIscsi.entrypoint name = '%s.%s' % (daemon_type, daemon_id) # So the container can modprobe iscsi_target_mod and have write perms @@ -2762,8 +2756,6 @@ def get_container(ctx: CephadmContext, # if using podman, set -d, --conmon-pidfile & --cidfile flags # so service can have Type=Forking - # set containers limits to unlimited as defaults (Docker 4096 / Podman 2048) - # prevents some app customizations from running if isinstance(ctx.container_engine, Podman): runtime_dir = '/run' container_args.extend([ @@ -2772,14 +2764,9 @@ def get_container(ctx: CephadmContext, runtime_dir + '/ceph-%s@%s.%s.service-pid' % (fsid, daemon_type, daemon_id), '--cidfile', runtime_dir + '/ceph-%s@%s.%s.service-cid' % (fsid, daemon_type, daemon_id), - '--pids-limit=-1', ]) if ctx.container_engine.version >= CGROUPS_SPLIT_PODMAN_VERSION: container_args.append('--cgroups=split') - else: - container_args.extend([ - '--pids-limit=0', - ]) return CephContainer.for_daemon( ctx, diff --git a/src/cephadm/tests/test_cephadm.py b/src/cephadm/tests/test_cephadm.py index 9e5412def5c3..2f3f0158245f 100644 --- a/src/cephadm/tests/test_cephadm.py +++ b/src/cephadm/tests/test_cephadm.py @@ -1262,11 +1262,11 @@ if ! grep -qs /var/lib/ceph/9b9d7609-f4d5-4aba-94c8-effa764d96c9/iscsi.daemon_id # iscsi tcmu-runner container ! /usr/bin/podman rm -f ceph-9b9d7609-f4d5-4aba-94c8-effa764d96c9-iscsi.daemon_id-tcmu 2> /dev/null ! /usr/bin/podman rm -f ceph-9b9d7609-f4d5-4aba-94c8-effa764d96c9-iscsi-daemon_id-tcmu 2> /dev/null -/usr/bin/podman run --rm --ipc=host --stop-signal=SIGTERM --net=host --entrypoint /usr/bin/tcmu-runner --privileged --group-add=disk --init --name ceph-9b9d7609-f4d5-4aba-94c8-effa764d96c9-iscsi-daemon_id-tcmu --pids-limit=0 -e CONTAINER_IMAGE=ceph/ceph -e NODE_NAME=host1 -e CEPH_USE_RANDOM_NONCE=1 -v /var/lib/ceph/9b9d7609-f4d5-4aba-94c8-effa764d96c9/iscsi.daemon_id/config:/etc/ceph/ceph.conf:z -v /var/lib/ceph/9b9d7609-f4d5-4aba-94c8-effa764d96c9/iscsi.daemon_id/keyring:/etc/ceph/keyring:z -v /var/lib/ceph/9b9d7609-f4d5-4aba-94c8-effa764d96c9/iscsi.daemon_id/iscsi-gateway.cfg:/etc/ceph/iscsi-gateway.cfg:z -v /var/lib/ceph/9b9d7609-f4d5-4aba-94c8-effa764d96c9/iscsi.daemon_id/configfs:/sys/kernel/config -v /var/log/ceph/9b9d7609-f4d5-4aba-94c8-effa764d96c9:/var/log:z -v /dev:/dev --mount type=bind,source=/lib/modules,destination=/lib/modules,ro=true ceph/ceph & +/usr/bin/podman run --rm --ipc=host --stop-signal=SIGTERM --net=host --entrypoint /usr/bin/tcmu-runner --privileged --group-add=disk --init --name ceph-9b9d7609-f4d5-4aba-94c8-effa764d96c9-iscsi-daemon_id-tcmu -e CONTAINER_IMAGE=ceph/ceph -e NODE_NAME=host1 -e CEPH_USE_RANDOM_NONCE=1 -v /var/lib/ceph/9b9d7609-f4d5-4aba-94c8-effa764d96c9/iscsi.daemon_id/config:/etc/ceph/ceph.conf:z -v /var/lib/ceph/9b9d7609-f4d5-4aba-94c8-effa764d96c9/iscsi.daemon_id/keyring:/etc/ceph/keyring:z -v /var/lib/ceph/9b9d7609-f4d5-4aba-94c8-effa764d96c9/iscsi.daemon_id/iscsi-gateway.cfg:/etc/ceph/iscsi-gateway.cfg:z -v /var/lib/ceph/9b9d7609-f4d5-4aba-94c8-effa764d96c9/iscsi.daemon_id/configfs:/sys/kernel/config -v /var/log/ceph/9b9d7609-f4d5-4aba-94c8-effa764d96c9:/var/log:z -v /dev:/dev --mount type=bind,source=/lib/modules,destination=/lib/modules,ro=true ceph/ceph & # iscsi.daemon_id ! /usr/bin/podman rm -f ceph-9b9d7609-f4d5-4aba-94c8-effa764d96c9-iscsi.daemon_id 2> /dev/null ! /usr/bin/podman rm -f ceph-9b9d7609-f4d5-4aba-94c8-effa764d96c9-iscsi-daemon_id 2> /dev/null -/usr/bin/podman run --rm --ipc=host --stop-signal=SIGTERM --net=host --entrypoint /usr/bin/rbd-target-api --privileged --group-add=disk --init --name ceph-9b9d7609-f4d5-4aba-94c8-effa764d96c9-iscsi-daemon_id --pids-limit=0 -e CONTAINER_IMAGE=ceph/ceph -e NODE_NAME=host1 -e CEPH_USE_RANDOM_NONCE=1 -v /var/lib/ceph/9b9d7609-f4d5-4aba-94c8-effa764d96c9/iscsi.daemon_id/config:/etc/ceph/ceph.conf:z -v /var/lib/ceph/9b9d7609-f4d5-4aba-94c8-effa764d96c9/iscsi.daemon_id/keyring:/etc/ceph/keyring:z -v /var/lib/ceph/9b9d7609-f4d5-4aba-94c8-effa764d96c9/iscsi.daemon_id/iscsi-gateway.cfg:/etc/ceph/iscsi-gateway.cfg:z -v /var/lib/ceph/9b9d7609-f4d5-4aba-94c8-effa764d96c9/iscsi.daemon_id/configfs:/sys/kernel/config -v /var/log/ceph/9b9d7609-f4d5-4aba-94c8-effa764d96c9:/var/log:z -v /dev:/dev --mount type=bind,source=/lib/modules,destination=/lib/modules,ro=true ceph/ceph +/usr/bin/podman run --rm --ipc=host --stop-signal=SIGTERM --net=host --entrypoint /usr/bin/rbd-target-api --privileged --group-add=disk --init --name ceph-9b9d7609-f4d5-4aba-94c8-effa764d96c9-iscsi-daemon_id -e CONTAINER_IMAGE=ceph/ceph -e NODE_NAME=host1 -e CEPH_USE_RANDOM_NONCE=1 -v /var/lib/ceph/9b9d7609-f4d5-4aba-94c8-effa764d96c9/iscsi.daemon_id/config:/etc/ceph/ceph.conf:z -v /var/lib/ceph/9b9d7609-f4d5-4aba-94c8-effa764d96c9/iscsi.daemon_id/keyring:/etc/ceph/keyring:z -v /var/lib/ceph/9b9d7609-f4d5-4aba-94c8-effa764d96c9/iscsi.daemon_id/iscsi-gateway.cfg:/etc/ceph/iscsi-gateway.cfg:z -v /var/lib/ceph/9b9d7609-f4d5-4aba-94c8-effa764d96c9/iscsi.daemon_id/configfs:/sys/kernel/config -v /var/log/ceph/9b9d7609-f4d5-4aba-94c8-effa764d96c9:/var/log:z -v /dev:/dev --mount type=bind,source=/lib/modules,destination=/lib/modules,ro=true ceph/ceph """ def test_get_container(self):