Repository navigation
docs(operations): pin the OOM defaults to their source and narrow the admission warning - #783
Open
myasnikovdaniil wants to merge 1 commit into
Open
myasnikovdaniil wants to merge 1 commit into
myasnikovdaniil wants to merge 1 commit into
Conversation
… admission warning The page named the Talos defaults without saying where to check them, and Talos's rendered OOMConfig reference differs from them: it shows one example document with a sampleInterval of 100ms against a 500ms default. The admission warning read as a general property. LimitRanger runs ahead of every mutating webhook and VPA keeps the request-to-limit ratio under RequestsAndLimits, so only a request declared on the workload can be listed in advance. The check counted containers that carry their own limit and missed workload templates, so a workload with no pods yet never showed up. Namespaces are read line by line because zsh does not split an unquoted variable, and a reader on zsh would get an empty result and take it for a clean one. kube-ovn's chart sets limits on its own containers but not on hostpath-init, which runs on six workloads, or on install-cni, yet the page said it sets both. linstor-controller carries requests and no chart-level limit on purpose, and the page did not say so. The Verifying snippet used the burstable cgroup directory for every pod and read an empty node address without complaint. The text is identical in v1.7 and next, and release-1.7 ships the same kube-ovn chart and linstor test, so both get the same change. Assisted-by: LLM Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
myasnikovdaniil
requested review from
Andrei Kvapil (kvaps),
Timofei Larkin (lllamnyp) and
Timur Tukaev (tym83)
as code owners
November 3, 2026 11:44
✅ Deploy Preview for cozystack ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
12 tasks
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Same fixes as cozystack/cozystack#3829, which edits
docs/operations/system-memory-limits.md. That file is deleted by cozystack/cozystack#5034 and this page is where it lives now, so the fixes go here and cozystack/cozystack#3829 gets closed.Both
v1.7andnextget the patch. Page text is identical in the two and release-1.7 has the same kube-ovn chart and the same linstor test, so the claims hold for both.DefaultOOMCgroupRankingExpressionandDefaultOOMTriggerExpressioninpkg/machinery/constants/constants.go(Talos v1.14.2) as the source of both CEL defaults. RenderedOOMConfigreference builds from the same constants but shows one example document, withsampleInterval: 100msagainst default500ms, so it is a bad place to check defaults.LimitRangerruns before every mutating webhook, so a request raised later hits a container that already has the defaulted limit. VPA withRequestsAndLimits(default, no VPA in the cozystack repo overrides it) rescales the limit together with the request,RequestsOnlyor any webhook raising the request alone does not. What can be listed in advance is a request declared on the workload, and the check command now does it for templates and live pods and skips containers with their own limit. It reads namespaces withwhile readbecause zsh does not split an unquoted variable.hostpath-inithas no memory limit (six workloads in default render, seventhovn-ic-controllerwithfunc.ENABLE_IC) andinstall-cnihas none either. Page said the chart sets both.linstor-controllerhas requests and no chart-level limit on purpose, pinned withnotExistsinpackages/system/linstor/tests/cluster_test.yamlin cozystack. Page did not say it.burstable/for every pod, now the directory comes from.status.qosClass, and it stops on an empty pod UID or node address.Checked against Talos v1.14.2 sources, API server plugin order on release-1.35 and 1.36, a render of the kube-ovn package from main and from release-1.7, and both snippets under bash and zsh with stubbed
kubectlandtalosctl. The scan ran on a test cluster too and matched a single-Aquery.talosctl readwas not run against a real node, and the site was not built locally (no node_modules, hugo 0.154.5 here against 0.164.0 in CI), so the deploy preview is the first render.