mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 14:02:56 +09:00
Myasnikov Daniil
69c6e89b4a
Three points from lexfrei's review. Pins both CEL blocks to the constants that define them, DefaultOOMCgroupRankingExpression and DefaultOOMTriggerExpression in pkg/machinery/constants/constants.go, and says to cross-check the constant at the tag rather than a rendered configuration reference. Verified both against siderolabs/talos at v1.13.6: they match this page verbatim. The reference pages are worth steering away from, because the OOMConfig doc comments point at the constant instead of inlining its value, so a rendered page can show an older expression while the shipped default has moved on. Narrows the admission-ordering warning to the case that can actually happen. The page presented a defaulted limit landing below a container's own request as the general hazard of lowering the knob, which overstates the routes into it. LimitRanger is an in-tree admission plugin at position 6 of AllOrderedPlugins while MutatingAdmissionWebhook is at 33 (pkg/kubeapiserver/options/plugins.go, release-1.35), so the LimitRange has already defaulted a container before any webhook sees the pod, and VPA "will also maintain ratios between requests and limits that were specified in initial containers configuration", so it rescales that limit rather than leaving a bare request above it. Only a statically declared request reaches the rejection. That also corrects why the check needs live pods: not to catch a webhook-raised request, but to catch a container still running from before the LimitRange was applied. Corrects the scope of the kube-ovn init containers. hostpath-init is not confined to the node DaemonSets: it runs on six workloads, three DaemonSets (ovs-ovn, kube-ovn-pinger, kube-ovn-cni) and three Deployments (ovn-central, kube-ovn-controller, kube-ovn-monitor), plus ovn-ic-controller under func.ENABLE_IC. install-cni is the one that is DaemonSet-only. Also follows the operator's field rename, describing what is logged as the workload rather than the pod. No command text changed. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>