Implement system-reserved-compressible

Author: ngopalak-redhat

pkg/controller/kubelet-config/helpers.go

@@ -390,6 +390,12 @@ func validateUserKubeletConfig(cfg *mcfgv1.KubeletConfig) error {
 		cfg.Spec.AutoSizingReserved != nil && *cfg.Spec.AutoSizingReserved {
 		return fmt.Errorf("KubeletConfiguration: autoSizingReserved and systemdReserved cannot be set together")
 	}
+	// Validate that systemReservedCgroup matches systemCgroups if both are set
+	if kcDecoded.SystemReservedCgroup != "" && kcDecoded.SystemCgroups != "" {
+		if kcDecoded.SystemReservedCgroup != kcDecoded.SystemCgroups {
+			return fmt.Errorf("KubeletConfiguration: systemReservedCgroup (%s) must match systemCgroups (%s)", kcDecoded.SystemReservedCgroup, kcDecoded.SystemCgroups)
+		}
+	}
 	return nil
 }
 
@@ -460,7 +466,7 @@ func kubeletConfigToIgnFile(cfg *kubeletconfigv1beta1.KubeletConfiguration) (*ig
 }
 
 // generateKubeletIgnFiles generates the Ignition files from the kubelet config
-func generateKubeletIgnFiles(kubeletConfig *mcfgv1.KubeletConfig, originalKubeConfig *kubeletconfigv1beta1.KubeletConfiguration) (*ign3types.File, *ign3types.File, *ign3types.File, error) {
+func generateKubeletIgnFiles(kubeletConfig *mcfgv1.KubeletConfig, originalKubeConfig *kubeletconfigv1beta1.KubeletConfiguration, role string, mcClient mcfgclientset.Interface) (*ign3types.File, *ign3types.File, *ign3types.File, error) {
 	var (
 		kubeletIgnition            *ign3types.File
 		logLevelIgnition           *ign3types.File
@@ -508,6 +514,35 @@ func generateKubeletIgnFiles(kubeletConfig *mcfgv1.KubeletConfig, originalKubeCo
 		}
 	}
 
+	// Handle systemReservedCgroup and enforceNodeAllocatable based on:
+	// 1. Presence of "50-{role}-system-compressible-disabled" MachineConfig (upgrade from 4.20)
+	// 2. OR reservedSystemCPUs being set (incompatible with systemReservedCgroup)
+	shouldDisableSystemReservedCgroup := false
+
+	// Check if the upgrade marker MachineConfig exists (only when mcClient is available, not during bootstrap)
+	if mcClient != nil {
+		compressibleDisabledMCName := fmt.Sprintf("50-%s-system-compressible-disabled", role)
+		_, mcErr := mcClient.MachineconfigurationV1().MachineConfigs().Get(context.TODO(), compressibleDisabledMCName, metav1.GetOptions{})
+		if mcErr == nil {
+			// MachineConfig exists, this is an upgrade from 4.20
+			shouldDisableSystemReservedCgroup = true
+			klog.Infof("Found MachineConfig %s, disabling systemReservedCgroup enforcement", compressibleDisabledMCName)
+		}
+	}
+
+	// Check if reservedSystemCPUs is set (incompatible with systemReservedCgroup)
+	if originalKubeConfig.ReservedSystemCPUs != "" {
+		shouldDisableSystemReservedCgroup = true
+		klog.Infof("reservedSystemCPUs is set to %s, disabling systemReservedCgroup enforcement", originalKubeConfig.ReservedSystemCPUs)
+	}
+
+	if shouldDisableSystemReservedCgroup {
+		// Clear systemReservedCgroup
+		originalKubeConfig.SystemReservedCgroup = ""
+		// Set enforceNodeAllocatable to only pods
+		originalKubeConfig.EnforceNodeAllocatable = []string{"pods"}
+	}
+
 	// Encode the new config into an Ignition File
 	kubeletIgnition, err := kubeletConfigToIgnFile(originalKubeConfig)
 	if err != nil {

pkg/controller/kubelet-config/kubelet_config_bootstrap.go

@@ -55,7 +55,7 @@ func RunKubeletBootstrap(templateDir string, kubeletConfigs []*mcfgv1.KubeletCon
 				originalKubeConfig.TLSCipherSuites = observedCipherSuites
 			}
 
-			kubeletIgnition, logLevelIgnition, autoSizingReservedIgnition, err := generateKubeletIgnFiles(kubeletConfig, originalKubeConfig)
+			kubeletIgnition, logLevelIgnition, autoSizingReservedIgnition, err := generateKubeletIgnFiles(kubeletConfig, originalKubeConfig, role, nil)
 			if err != nil {
 				return nil, err
 			}

pkg/controller/kubelet-config/kubelet_config_controller.go

@@ -652,7 +652,7 @@ func (ctrl *Controller) syncKubeletConfig(key string) error {
 			originalKubeConfig.TLSCipherSuites = observedCipherSuites
 		}
 
-		kubeletIgnition, logLevelIgnition, autoSizingReservedIgnition, err := generateKubeletIgnFiles(cfg, originalKubeConfig)
+		kubeletIgnition, logLevelIgnition, autoSizingReservedIgnition, err := generateKubeletIgnFiles(cfg, originalKubeConfig, role, ctrl.client)
 		if err != nil {
 			return ctrl.syncStatusOnly(cfg, err)
 		}

templates/arbiter/01-arbiter-kubelet/_base/files/kubelet.yaml

@@ -28,6 +28,10 @@ contents:
     memorySwap:
       swapBehavior: NoSwap
     systemCgroups: /system.slice
+    systemReservedCgroup: /system.slice
+    enforceNodeAllocatable:
+      - pods
+      - system-reserved-compressible
     nodeStatusUpdateFrequency: 10s
     nodeStatusReportFrequency: 5m
     serverTLSBootstrap: true

templates/master/01-master-kubelet/_base/files/kubelet.yaml

@@ -28,6 +28,10 @@ contents:
     memorySwap:
       swapBehavior: NoSwap
     systemCgroups: /system.slice
+    systemReservedCgroup: /system.slice
+    enforceNodeAllocatable:
+      - pods
+      - system-reserved-compressible
     nodeStatusUpdateFrequency: 10s
     nodeStatusReportFrequency: 5m
     serverTLSBootstrap: true

templates/worker/01-worker-kubelet/_base/files/kubelet.yaml

@@ -28,6 +28,10 @@ contents:
     memorySwap:
       swapBehavior: NoSwap
     systemCgroups: /system.slice
+    systemReservedCgroup: /system.slice
+    enforceNodeAllocatable:
+      - pods
+      - system-reserved-compressible
     nodeStatusUpdateFrequency: 10s
     nodeStatusReportFrequency: 5m
     serverTLSBootstrap: true