How to disable unidling across the cluster?

Solution Unverified - Updated -

Environment

  • OpenShift Container Platform (OCP) 3.9, 3.10 and 3.11

Issue

  • Unidling is causing iptables lock contention.
  • Is there a parameter to disable Unidling using the node-config.yaml?

Resolution

Please take into account that instruction differs between versions.
OCP 3.9

  • Add the parameter enableUnidling, set it to false in the configuration file /etc/origin/node/node-config.yaml.

    ...
     dockerConfig:
      dockerShimRootDirectory: /var/lib/dockershim
      dockerShimSocket: /var/run/dockershim.sock
      execHandlerName: native
    enableUnidling: false
    imageConfig:
      format: "{{ openshift_imageconfig_format }}"
      latest: false
    iptablesSyncPeriod: 30s
    ...
    
  • Restart the atomic-openshift-node service.

    # systemctl restart atomic-openshift-node
    

OCP 3.10 and 3.11

Starting in OpenShift 3.10, the node configuration is managed by making updates to the configmaps for each type of node to be configured.

  • Edit the corresponding configmap. For example, to modify the compute configmap run the following:

    # oc edit cm/node-config-compute -n openshift-node 
    
  • Add parameter enableUnidling, set it to false:

    ...
     dockerConfig:
      dockerShimRootDirectory: /var/lib/dockershim
      dockerShimSocket: /var/run/dockershim.sock
      execHandlerName: native
    enableUnidling: false
    imageConfig:
      format: "{{ openshift_imageconfig_format }}"
      latest: false
    iptablesSyncPeriod: 30s
    ...
    

Root Cause

  • By default, the parameter enableUnidling is set to true in the node-config.yaml on the openshift-ansible template.

    openshift-ansible/roles/openshift_node_group/templates/node-config.yaml.j2
    ...
     dockerConfig:
      dockerShimRootDirectory: /var/lib/dockershim
      dockerShimSocket: /var/run/dockershim.sock
      execHandlerName: native
    enableUnidling: true
    imageConfig:
      format: "{{ openshift_imageconfig_format }}"
      latest: false
    iptablesSyncPeriod: 30s
    ...
    

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.