From 47149a5483d3c981427415db1d45dc7678358dbb Mon Sep 17 00:00:00 2001 From: Teoman ONAY Date: Tue, 3 Aug 2021 16:06:53 +0200 Subject: [PATCH] podman pids.max default value is 2048, docker's one is 4096 which are sufficient for the default value (512) of rgw thread pool size. But if its value is increased near to the pids-limit value, it does not leave place for the other processes to spawn and run within the container and the container crashes. pids-limit set to unlimited regardless of the container engine. Closes: https://bugzilla.redhat.com/show_bug.cgi?id=1987041 Signed-off-by: Teoman ONAY (cherry picked from commit 9b5d97adb95a788bc1fdedbba562a9c71a1808be) --- roles/ceph-crash/templates/ceph-crash.service.j2 | 1 + roles/ceph-grafana/templates/grafana-server.service.j2 | 1 + roles/ceph-iscsi-gw/templates/rbd-target-api.service.j2 | 1 + roles/ceph-iscsi-gw/templates/rbd-target-gw.service.j2 | 1 + roles/ceph-iscsi-gw/templates/tcmu-runner.service.j2 | 1 + roles/ceph-mds/templates/ceph-mds.service.j2 | 1 + roles/ceph-mgr/templates/ceph-mgr.service.j2 | 1 + roles/ceph-mon/templates/ceph-mon.service.j2 | 1 + roles/ceph-nfs/templates/ceph-nfs.service.j2 | 1 + roles/ceph-node-exporter/templates/node_exporter.service.j2 | 1 + roles/ceph-osd/templates/ceph-osd.service.j2 | 1 + roles/ceph-prometheus/templates/alertmanager.service.j2 | 1 + roles/ceph-prometheus/templates/prometheus.service.j2 | 1 + roles/ceph-rbd-mirror/templates/ceph-rbd-mirror.service.j2 | 1 + roles/ceph-rgw/templates/ceph-radosgw.service.j2 | 1 + 15 files changed, 15 insertions(+) diff --git a/roles/ceph-crash/templates/ceph-crash.service.j2 b/roles/ceph-crash/templates/ceph-crash.service.j2 index fd9468921..5343d02df 100644 --- a/roles/ceph-crash/templates/ceph-crash.service.j2 +++ b/roles/ceph-crash/templates/ceph-crash.service.j2 @@ -17,6 +17,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --name ceph-crash-%i \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} +--pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --net=host \ -v /var/lib/ceph:/var/lib/ceph:z \ -v /etc/localtime:/etc/localtime:ro \ diff --git a/roles/ceph-grafana/templates/grafana-server.service.j2 b/roles/ceph-grafana/templates/grafana-server.service.j2 index 1fb57f316..da82bd586 100644 --- a/roles/ceph-grafana/templates/grafana-server.service.j2 +++ b/roles/ceph-grafana/templates/grafana-server.service.j2 @@ -22,6 +22,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --name=grafana-server \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ -v /etc/grafana:/etc/grafana:Z \ -v /var/lib/grafana:/var/lib/grafana:Z \ --net=host \ diff --git a/roles/ceph-iscsi-gw/templates/rbd-target-api.service.j2 b/roles/ceph-iscsi-gw/templates/rbd-target-api.service.j2 index 7adc3b431..f480c7a07 100644 --- a/roles/ceph-iscsi-gw/templates/rbd-target-api.service.j2 +++ b/roles/ceph-iscsi-gw/templates/rbd-target-api.service.j2 @@ -21,6 +21,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --memory={{ ceph_rbd_target_api_docker_memory_limit }} \ --cpus={{ ceph_rbd_target_api_docker_cpu_limit }} \ -v /etc/localtime:/etc/localtime:ro \ diff --git a/roles/ceph-iscsi-gw/templates/rbd-target-gw.service.j2 b/roles/ceph-iscsi-gw/templates/rbd-target-gw.service.j2 index 78397e126..0b3a04936 100644 --- a/roles/ceph-iscsi-gw/templates/rbd-target-gw.service.j2 +++ b/roles/ceph-iscsi-gw/templates/rbd-target-gw.service.j2 @@ -21,6 +21,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --memory={{ ceph_rbd_target_gw_docker_memory_limit }} \ --cpus={{ ceph_rbd_target_gw_docker_cpu_limit }} \ -v /etc/localtime:/etc/localtime:ro \ diff --git a/roles/ceph-iscsi-gw/templates/tcmu-runner.service.j2 b/roles/ceph-iscsi-gw/templates/tcmu-runner.service.j2 index 6d9dc3bf7..d35917f87 100644 --- a/roles/ceph-iscsi-gw/templates/tcmu-runner.service.j2 +++ b/roles/ceph-iscsi-gw/templates/tcmu-runner.service.j2 @@ -21,6 +21,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --memory={{ ceph_tcmu_runner_docker_memory_limit }} \ --cpus={{ ceph_tcmu_runner_docker_cpu_limit }} \ -v /etc/localtime:/etc/localtime:ro \ diff --git a/roles/ceph-mds/templates/ceph-mds.service.j2 b/roles/ceph-mds/templates/ceph-mds.service.j2 index c681146cb..54b2d7ac8 100644 --- a/roles/ceph-mds/templates/ceph-mds.service.j2 +++ b/roles/ceph-mds/templates/ceph-mds.service.j2 @@ -22,6 +22,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --net=host \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --memory={{ ceph_mds_docker_memory_limit }} \ --cpus={{ cpu_limit }} \ -v /var/lib/ceph:/var/lib/ceph:z \ diff --git a/roles/ceph-mgr/templates/ceph-mgr.service.j2 b/roles/ceph-mgr/templates/ceph-mgr.service.j2 index 56c49c4a6..2cca6364b 100644 --- a/roles/ceph-mgr/templates/ceph-mgr.service.j2 +++ b/roles/ceph-mgr/templates/ceph-mgr.service.j2 @@ -21,6 +21,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --net=host \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --memory={{ ceph_mgr_docker_memory_limit }} \ --cpus={{ ceph_mgr_docker_cpu_limit }} \ -v /var/lib/ceph:/var/lib/ceph:z,rshared \ diff --git a/roles/ceph-mon/templates/ceph-mon.service.j2 b/roles/ceph-mon/templates/ceph-mon.service.j2 index ed95cc60b..bdcc1063b 100644 --- a/roles/ceph-mon/templates/ceph-mon.service.j2 +++ b/roles/ceph-mon/templates/ceph-mon.service.j2 @@ -22,6 +22,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --name ceph-mon-%i \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --memory={{ ceph_mon_docker_memory_limit }} \ --cpus={{ ceph_mon_docker_cpu_limit }} \ -v /var/lib/ceph:/var/lib/ceph:z,rshared \ diff --git a/roles/ceph-nfs/templates/ceph-nfs.service.j2 b/roles/ceph-nfs/templates/ceph-nfs.service.j2 index f3e3ac4bf..e053788e8 100644 --- a/roles/ceph-nfs/templates/ceph-nfs.service.j2 +++ b/roles/ceph-nfs/templates/ceph-nfs.service.j2 @@ -21,6 +21,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --net=host \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ -v /var/lib/ceph:/var/lib/ceph:z \ -v /etc/ceph:/etc/ceph:z \ -v /var/lib/nfs/ganesha:/var/lib/nfs/ganesha:z \ diff --git a/roles/ceph-node-exporter/templates/node_exporter.service.j2 b/roles/ceph-node-exporter/templates/node_exporter.service.j2 index d3228a119..346c84e62 100644 --- a/roles/ceph-node-exporter/templates/node_exporter.service.j2 +++ b/roles/ceph-node-exporter/templates/node_exporter.service.j2 @@ -20,6 +20,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --name=node-exporter \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --privileged \ -v /proc:/host/proc:ro -v /sys:/host/sys:ro \ --net=host \ diff --git a/roles/ceph-osd/templates/ceph-osd.service.j2 b/roles/ceph-osd/templates/ceph-osd.service.j2 index fb179dde5..75ea7195a 100644 --- a/roles/ceph-osd/templates/ceph-osd.service.j2 +++ b/roles/ceph-osd/templates/ceph-osd.service.j2 @@ -27,6 +27,7 @@ numactl \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --rm \ --net=host \ --privileged=true \ diff --git a/roles/ceph-prometheus/templates/alertmanager.service.j2 b/roles/ceph-prometheus/templates/alertmanager.service.j2 index 28280c3d6..a621c8a76 100644 --- a/roles/ceph-prometheus/templates/alertmanager.service.j2 +++ b/roles/ceph-prometheus/templates/alertmanager.service.j2 @@ -21,6 +21,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --name=alertmanager \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ -v "{{ alertmanager_conf_dir }}:/etc/alertmanager:Z" \ -v "{{ alertmanager_data_dir }}:/alertmanager:Z" \ --net=host \ diff --git a/roles/ceph-prometheus/templates/prometheus.service.j2 b/roles/ceph-prometheus/templates/prometheus.service.j2 index 3f2ed5602..8202cf22e 100644 --- a/roles/ceph-prometheus/templates/prometheus.service.j2 +++ b/roles/ceph-prometheus/templates/prometheus.service.j2 @@ -20,6 +20,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --name=prometheus \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ -v "{{ prometheus_conf_dir }}:/etc/prometheus:Z" \ -v "{{ prometheus_data_dir }}:/prometheus:Z" \ --net=host \ diff --git a/roles/ceph-rbd-mirror/templates/ceph-rbd-mirror.service.j2 b/roles/ceph-rbd-mirror/templates/ceph-rbd-mirror.service.j2 index 48c0b3d17..c9e87acdd 100644 --- a/roles/ceph-rbd-mirror/templates/ceph-rbd-mirror.service.j2 +++ b/roles/ceph-rbd-mirror/templates/ceph-rbd-mirror.service.j2 @@ -21,6 +21,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --net=host \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --memory={{ ceph_rbd_mirror_docker_memory_limit }} \ --cpus={{ ceph_rbd_mirror_docker_cpu_limit }} \ -v /var/lib/ceph:/var/lib/ceph:z \ diff --git a/roles/ceph-rgw/templates/ceph-radosgw.service.j2 b/roles/ceph-rgw/templates/ceph-radosgw.service.j2 index 7c007e5bd..881b970ab 100644 --- a/roles/ceph-rgw/templates/ceph-radosgw.service.j2 +++ b/roles/ceph-rgw/templates/ceph-radosgw.service.j2 @@ -22,6 +22,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --net=host \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --memory={{ ceph_rgw_docker_memory_limit }} \ --cpus={{ cpu_limit }} \ {% if ceph_rgw_docker_cpuset_cpus is defined -%}