https://rancher.com/ logo
#rke2
Title
b

blue-controller-9088

02/01/2023, 9:16 PM
Anybody knows how to change ulimit for memlock in RKE2 (containerd)? In RKE1 we set it via /etc/docker/daemon.json, something like this: --
{
"log-driver": "json-file",
"log-opts": {
"max-size": "100m",
"max-file": "3"
},
"default-ulimits": {
"memlock": {
"Name": "memlock",
"Hard": -1,
"Soft": -1
}
}
}
--- In RKE2 I tried it via /etc/security/limits.conf, but it’s not working, still can see mlock=64 in pods. Appreciate any suggestions. We run ubuntu 22.04 on nodes.
c

creamy-pencil-82913

02/01/2023, 9:18 PM
set them in the rke2 systemd unit
Copy code
LimitMEMLOCK=
LimitLOCKS=
and so on.
b

blue-controller-9088

02/01/2023, 9:24 PM
you meant in rke2-server unit?
It’s rke2 downstream cluster
c

creamy-pencil-82913

02/01/2023, 9:26 PM
rke2-server rke2-agent, whatever you have
b

blue-controller-9088

02/01/2023, 9:27 PM
rke2-server what I have. Will try it.
Yep, this works, thanks Brandon!
Well, sort of working. Something is getting restored it back after node reboot. I’m wandering what it could be and how to make it persistent?
c

creamy-pencil-82913

02/01/2023, 10:57 PM
something is rewriting your systemd unit file?
rke2 doesn’t manage that file, so it would have to be something else
b

blue-controller-9088

02/01/2023, 11:04 PM
I suspect it’s system-upgrade-controller
I had to do it in /etc/systemd/system.conf DefaultLimit* instead of unit file
c

creamy-pencil-82913

02/01/2023, 11:06 PM
no, that wouldn’t manage it either, that just replaces the binary
If the node was provisioned by Rancher then it would be managed by rancher-system-agent
b

blue-controller-9088

02/01/2023, 11:07 PM
yes, it’s rancher downstream cluster
c

creamy-pencil-82913

02/01/2023, 11:07 PM
there are many kinds of downstream clusters
not all of them are provisioned by rancher
b

blue-controller-9088

02/01/2023, 11:08 PM
it’s custom, we manage nodes ourselves
c

creamy-pencil-82913

02/01/2023, 11:08 PM
so you provisioned it via Rancher, as opposed to installing RKE2 manually and then importing it into Rancher
b

blue-controller-9088

02/01/2023, 11:10 PM
yep, create cluster, then install agent via cloud-init. Usual stuff. It’s bare-metal nodes BTW
c

creamy-pencil-82913

02/01/2023, 11:12 PM
yeah so that is what we could call a Rancher provisioned cluster, and the config is managed by rancher-system-agent
b

blue-controller-9088

02/01/2023, 11:12 PM
yep
92 Views