kubelet: new kubelet config option for disabling group oom kill

[utam0k]

What type of PR is this?

/kind feature

What this PR does / why we need it:

There is a difference in the OOM behavior between cgroup v1 and v2 by default. It's important to note that in cgroup v1 if one of the processes within a container is killed, the other processes will remain running. Ideally, we might want to align with cgroup v2's behavior, where all processes within a container are killed if an OOM event occurs. However, in reality, we need to maintain the behavior of cgroup v1 for the time being. Therefore, this pull request will introduce the singleProcessOOMKill flag to enable like cgroup v1's behavior in cgroup v2.

• use the cgroup aware OOM killer if available #117793 (comment)
• use the cgroup aware OOM killer if available #117793 (comment)

Appearently, this workaround has already been discussed in a SIG-Node meeting.
#117793 (comment)

Which issue(s) this PR fixes:

Carry: #122813 by @tzneal

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Added `singleProcessOOMKill` flag to the kubelet configuration. Setting that to true enable single process OOM killing in cgroups v2. In this mode, if a single process is OOM killed within a container, the remaining processes will not be OOM killed.

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

[k8s-ci-robot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[k8s-ci-robot]

This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[kannon92]

/cc @tzneal

[kannon92]

/label api-review

[liggitt]

cc @bobbypage for review of cgroupv1-compatible options when running with cgroupv2

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: utam0k
Once this PR has been reviewed and has the lgtm label, please assign liggitt for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• cmd/kubelet/OWNERS
• pkg/generated/openapi/OWNERS
• pkg/kubelet/OWNERS
• pkg/kubelet/apis/config/OWNERS
• staging/src/k8s.io/kubelet/config/OWNERS
• test/e2e_node/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[cici37]

/remove-sig api-machinery

[kannon92]

@utam0k It would be really nice to get this into 1.32. Can you please address @liggitt comments?

[yujuhong]

@utam0k It would be really nice to get this into 1.32. Can you please address @liggitt comments?

+1

Would like to see this get in. If not, maybe we can try to find someone else to pick up?

[utam0k]

I will make time on Saturday and Sunday for the challenge. If I can't, I will ask someone else to pick up it.

[toVersus]

On non-Linux platforms, the default value for SingleProcessOOMKill is set to false and has no effect. Since the IsCgroup2UnifiedMode(), which checks if the system is running in cgroup v2 mode, always returns false on non-Linux platforms, I think it makes more sense to align the behavior with what it does in cgroup v1 mode. If it's fine for SingleProcessOOMKill to default to true, then we could simplify the defaulting logic like this:

		if !kubeletutil.IsCgroup2UnifiedMode() {
			// This is a default behavior for cgroups v1 and non-Linux platforms.
			obj.SingleProcessOOMKill = utilpointer.Bool(true)
		 else {
			obj.SingleProcessOOMKill = utilpointer.Bool(false)
		}