From df10b51c910f55cb9b334e8d66a12e9b3c46b001 Mon Sep 17 00:00:00 2001 From: Adam Farden Date: Sun, 3 May 2020 09:27:54 +0200 Subject: [PATCH] [systemd] Add value to LimitNOFILE due to performance problems When k3s is installed on an OS with default high ulimits, performance issues can be observed. This was discovered on CoreOS where the default value is 1073741816. Symptoms include very slow file operations such as installing a Rook/Ceph cluster will take ~6 hours instead of ~10 minutes. A google search for 'container LimitNOFILE' will show that most major projects set this already, including the (unused) containerd systemd unit found in this repository at /vendor/github.com/containerd/containerd/containerd.service k3OS is not affected becuasse the default there is already 1048576. See description in coreos/fedora-coreos-tracker#329 --- roles/k3s/master/templates/k3s.service.j2 | 4 +++- roles/k3s/node/templates/k3s.service.j2 | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/roles/k3s/master/templates/k3s.service.j2 b/roles/k3s/master/templates/k3s.service.j2 index 1d6c5d2..d0f7dcc 100644 --- a/roles/k3s/master/templates/k3s.service.j2 +++ b/roles/k3s/master/templates/k3s.service.j2 @@ -10,7 +10,9 @@ ExecStartPre=-/sbin/modprobe overlay ExecStart=/usr/local/bin/k3s server {{ extra_server_args | default("") }} KillMode=process Delegate=yes -LimitNOFILE=infinity +# Having non-zero Limit*s causes performance problems due to accounting overhead +# in the kernel. We recommend using cgroups to do container-local accounting. +LimitNOFILE=1048576 LimitNPROC=infinity LimitCORE=infinity TasksMax=infinity diff --git a/roles/k3s/node/templates/k3s.service.j2 b/roles/k3s/node/templates/k3s.service.j2 index 76c9276..cf49121 100644 --- a/roles/k3s/node/templates/k3s.service.j2 +++ b/roles/k3s/node/templates/k3s.service.j2 @@ -10,7 +10,9 @@ ExecStartPre=-/sbin/modprobe overlay ExecStart=/usr/local/bin/k3s agent --server https://{{ master_ip }}:6443 --token {{ hostvars[groups['master'][0]]['token'] }} KillMode=process Delegate=yes -LimitNOFILE=infinity +# Having non-zero Limit*s causes performance problems due to accounting overhead +# in the kernel. We recommend using cgroups to do container-local accounting. +LimitNOFILE=1048576 LimitNPROC=infinity LimitCORE=infinity TasksMax=infinity