Simple pod to test system partitioning #695
Description
The environment I currently have consists of:
-
OpenShift deployment via
openshift-installerbranchrelease-4.8(built from source) withlibvirtd, one master and one worker; -
PAO deployment following https://docs.openshift.com/container-platform/4.7; and
-
PerformanceProfile:apiVersion: performance.openshift.io/v2 kind: PerformanceProfile metadata: name: perfprofwork namespace: openshift-performance-addon-operator spec: cpu: isolated: "2-7" reserved: "0-1" realTimeKernel: enabled: false numa: topologyPolicy: "none" nodeSelector: node-role.kubernetes.io/worker: ""
Once I did this the worker node rebooted and several tasks were moved to the reserved (housekeeping) VCPUs 0-1, as expected. Based on that I assume(d) that the overall setup is functional.
As a final test I wanted to deploy a simple pod on the reserved VCPUs. To do this I:
-
Deployed a test namespace with the appropriate annotation:
apiVersion: v1 kind: Namespace metadata: name: ns-1 annotations: workload.openshift.io/allowed: "management"
-
Deployed a pod with the appropriate annotation:
apiVersion: v1 kind: Pod metadata: name: pod-1x namespace: ns-1 annotations: target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}' spec: restartPolicy: Never nodeSelector: node-role.kubernetes.io/worker: "" containers: - name: cont-1x image: rhel-minimal command: ["sleep", "infinity"] resources: requests: cpu: 100m memory: 256Mi
However, when I check the process CPU mask I get all VCPUs, not just the reserved ones as I expected:
[nelson@nelson-210-ctr test]$ oc get -n ns-1 pod pod-1x -o jsonpath='{.metadata.uid}'
0704aa94-bb3c-43e3-a586-b2ac43a4ade1
[nelson@nelson-210-ctr test]$ oc describe pod -n ns-1 | grep "Container ID"
Container ID: cri-o://a7d7a7c6fe0361c11b3ddd0804f07872f2f614d87c12d4037bf3e0ffdb6d1f9c
[core@test1-s57sm-worker-0-gmh7j ~]$ cd /sys/fs/cgroup/cpuset/kubepods.slice/kubepods-burstable.slice/kubepods-burstable-pod0704aa94_bb3c_43e3_a586_b2ac43a4ade1.slice/crio-a7d7a7c6fe0361c11b3ddd0804f07872f2f614d87c12d4037bf3e0ffdb6d1f9c.scope/
[core@test1-s57sm-worker-0-gmh7j ...]$ cat tasks
597427
[core@test1-s57sm-worker-0-gmh7j ...]$ cat /proc/597427/comm
sleep
[core@test1-s57sm-worker-0-gmh7j ...]$ cat /proc/597427/status | grep Cpus
Cpus_allowed: ff
Cpus_allowed_list: 0-7
The process name matches the one I am running, but the mask still shows 0-7. Am I missing anything? I am happy to provide more information if needed.