From 99086c85bf9eda403bceb77e9c927aba0e1494cb Mon Sep 17 00:00:00 2001 From: k8s-infra-cherrypick-robot <90416843+k8s-infra-cherrypick-robot@users.noreply.github.com> Date: Sat, 26 Sep 2026 02:38:30 -0700 Subject: [PATCH] Set priorityClassName and priority on static pods (#13580) With priority only (#13490), the API server rejects the mirror pods and the kubelet does not give the pods the node-critical OOM score. Set both fields, like kubeadm does for its static pods. Signed-off-by: Ali Afsharzadeh Co-authored-by: Ali Afsharzadeh --- .../kubernetes/node/templates/manifests/haproxy.manifest.j2 | 6 +++--- .../node/templates/manifests/kube-vip.manifest.j2 | 6 +++--- .../node/templates/manifests/nginx-proxy.manifest.j2 | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/roles/kubernetes/node/templates/manifests/haproxy.manifest.j2 b/roles/kubernetes/node/templates/manifests/haproxy.manifest.j2 index 78572b411..c940fbbcf 100644 --- a/roles/kubernetes/node/templates/manifests/haproxy.manifest.j2 +++ b/roles/kubernetes/node/templates/manifests/haproxy.manifest.j2 @@ -13,10 +13,10 @@ spec: dnsPolicy: ClusterFirstWithHostNet nodeSelector: kubernetes.io/os: linux -{# Static pods do not support priorityClassName, so set the numeric priority of - system-node-critical directly, otherwise kubelet may evict this pod early: - https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#pod-selection-for-kubelet-eviction #} +{# Set both, like kubeadm. The kubelet does not resolve priorityClassName for static pods, + and the API server rejects the mirror pod when priority does not match the class. #} priority: 2000001000 + priorityClassName: system-node-critical containers: - name: haproxy image: {{ haproxy_image_repo }}:{{ haproxy_image_tag }} diff --git a/roles/kubernetes/node/templates/manifests/kube-vip.manifest.j2 b/roles/kubernetes/node/templates/manifests/kube-vip.manifest.j2 index 69395fab1..93d8f1517 100644 --- a/roles/kubernetes/node/templates/manifests/kube-vip.manifest.j2 +++ b/roles/kubernetes/node/templates/manifests/kube-vip.manifest.j2 @@ -144,10 +144,10 @@ spec: - kubernetes ip: 127.0.0.1 hostNetwork: true -{# Static pods do not support priorityClassName, so set the numeric priority of - system-node-critical directly, otherwise kubelet may evict this pod early: - https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#pod-selection-for-kubelet-eviction #} +{# Set both, like kubeadm. The kubelet does not resolve priorityClassName for static pods, + and the API server rejects the mirror pod when priority does not match the class. #} priority: 2000001000 + priorityClassName: system-node-critical volumes: - hostPath: path: /etc/kubernetes/{{kube_vip_admin_conf}} diff --git a/roles/kubernetes/node/templates/manifests/nginx-proxy.manifest.j2 b/roles/kubernetes/node/templates/manifests/nginx-proxy.manifest.j2 index 4064455bf..369b9828f 100644 --- a/roles/kubernetes/node/templates/manifests/nginx-proxy.manifest.j2 +++ b/roles/kubernetes/node/templates/manifests/nginx-proxy.manifest.j2 @@ -13,10 +13,10 @@ spec: dnsPolicy: ClusterFirstWithHostNet nodeSelector: kubernetes.io/os: linux -{# Static pods do not support priorityClassName, so set the numeric priority of - system-node-critical directly, otherwise kubelet may evict this pod early: - https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#pod-selection-for-kubelet-eviction #} +{# Set both, like kubeadm. The kubelet does not resolve priorityClassName for static pods, + and the API server rejects the mirror pod when priority does not match the class. #} priority: 2000001000 + priorityClassName: system-node-critical containers: - name: nginx-proxy image: {{ nginx_image_repo }}:{{ nginx_image_tag }}