OCPNODE-4601: Add {system,container}GomaxprocsBehavior field

features.md

@@ -66,6 +66,7 @@
 | GCPCustomAPIEndpoints| | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
 | GCPCustomAPIEndpointsInstall| | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
 | GCPDualStackInstall| | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
+| GomaxprocsInjection| | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
 | HyperShiftOnlyDynamicResourceAllocation| <span style="background-color: #519450">Enabled</span> | | <span style="background-color: #519450">Enabled</span> | | <span style="background-color: #519450">Enabled</span> | | <span style="background-color: #519450">Enabled</span> |  |
 | ImageModeStatusReporting| | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
 | IngressComponentRouteLabels| | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |

features/features.go

@@ -1068,4 +1068,12 @@ var (
 					enhancementPR("https://github.com/openshift/enhancements/pull/2007").
 					enable(inClusterProfile(SelfManaged), inDevPreviewNoUpgrade()).
 					mustRegister()
+
+	FeatureGateGomaxprocsInjection = newFeatureGate("GomaxprocsInjection").
+					reportProblemsToJiraComponent("node").
+					contactPerson("haircommander").
+					productScope(ocpSpecific).
+					enhancementPR("https://github.com/openshift/enhancements/pull/2047").
+					enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()).
+					mustRegister()
 )

machineconfiguration/v1/tests/containerruntimeconfigs.machineconfiguration.openshift.io/GomaxprocsInjection.yaml

@@ -0,0 +1,55 @@
+apiVersion: apiextensions.k8s.io/v1 # Hack because controller-gen complains if we don't have this
+name: "ContainerRuntimeConfig"
+crdName: containerruntimeconfigs.machineconfiguration.openshift.io
+featureGates:
+- GomaxprocsInjection
+tests:
+  onCreate:
+    - name: Should be able to create ContainerRuntimeConfig with containerGomaxprocsBehavior set to Autosize
+      initial: |
+        apiVersion: machineconfiguration.openshift.io/v1
+        kind: ContainerRuntimeConfig
+        spec:
+          containerRuntimeConfig:
+            containerGomaxprocsBehavior: Autosize
+      expected: |
+        apiVersion: machineconfiguration.openshift.io/v1
+        kind: ContainerRuntimeConfig
+        spec:
+          containerRuntimeConfig:
+            containerGomaxprocsBehavior: Autosize
+
+    - name: Should be able to create ContainerRuntimeConfig with containerGomaxprocsBehavior set to Disabled
+      initial: |
+        apiVersion: machineconfiguration.openshift.io/v1
+        kind: ContainerRuntimeConfig
+        spec:
+          containerRuntimeConfig:
+            containerGomaxprocsBehavior: Disabled
+      expected: |
+        apiVersion: machineconfiguration.openshift.io/v1
+        kind: ContainerRuntimeConfig
+        spec:
+          containerRuntimeConfig:
+            containerGomaxprocsBehavior: Disabled
+
+    - name: Should fail if containerGomaxprocsBehavior has an invalid value
+      initial: |
+        apiVersion: machineconfiguration.openshift.io/v1
+        kind: ContainerRuntimeConfig
+        spec:
+          containerRuntimeConfig:
+            containerGomaxprocsBehavior: Enabled
+      expectedError: "spec.containerRuntimeConfig.containerGomaxprocsBehavior: Unsupported value"
+
+    - name: Should be able to create ContainerRuntimeConfig without containerGomaxprocsBehavior
+      initial: |
+        apiVersion: machineconfiguration.openshift.io/v1
+        kind: ContainerRuntimeConfig
+        spec:
+          containerRuntimeConfig: {}
+      expected: |
+        apiVersion: machineconfiguration.openshift.io/v1
+        kind: ContainerRuntimeConfig
+        spec:
+          containerRuntimeConfig: {}

machineconfiguration/v1/tests/kubeletconfigs.machineconfiguration.openshift.io/GomaxprocsInjection.yaml

@@ -0,0 +1,48 @@
+apiVersion: apiextensions.k8s.io/v1 # Hack because controller-gen complains if we don't have this
+name: "KubeletConfig"
+crdName: kubeletconfigs.machineconfiguration.openshift.io
+featureGates:
+- GomaxprocsInjection
+tests:
+  onCreate:
+    - name: Should be able to create KubeletConfig with systemGomaxprocsBehavior set to Autosize
+      initial: |
+        apiVersion: machineconfiguration.openshift.io/v1
+        kind: KubeletConfig
+        spec:
+          systemGomaxprocsBehavior: Autosize
+      expected: |
+        apiVersion: machineconfiguration.openshift.io/v1
+        kind: KubeletConfig
+        spec:
+          systemGomaxprocsBehavior: Autosize
+
+    - name: Should be able to create KubeletConfig with systemGomaxprocsBehavior set to Disabled
+      initial: |
+        apiVersion: machineconfiguration.openshift.io/v1
+        kind: KubeletConfig
+        spec:
+          systemGomaxprocsBehavior: Disabled
+      expected: |
+        apiVersion: machineconfiguration.openshift.io/v1
+        kind: KubeletConfig
+        spec:
+          systemGomaxprocsBehavior: Disabled
+
+    - name: Should fail if systemGomaxprocsBehavior has an invalid value
+      initial: |
+        apiVersion: machineconfiguration.openshift.io/v1
+        kind: KubeletConfig
+        spec:
+          systemGomaxprocsBehavior: Enabled
+      expectedError: "spec.systemGomaxprocsBehavior: Unsupported value"
+
+    - name: Should be able to create KubeletConfig without systemGomaxprocsBehavior
+      initial: |
+        apiVersion: machineconfiguration.openshift.io/v1
+        kind: KubeletConfig
+        spec: {}
+      expected: |
+        apiVersion: machineconfiguration.openshift.io/v1
+        kind: KubeletConfig
+        spec: {}

machineconfiguration/v1/types.go

@@ -768,6 +768,22 @@ type KubeletConfigSpec struct {
 	// When specified, the type field can be set to either "Old", "Intermediate", "Modern", "Custom" or omitted for backward compatibility.
 	// +optional
 	TLSSecurityProfile *configv1.TLSSecurityProfile `json:"tlsSecurityProfile,omitempty"`
+
+	// systemGomaxprocsBehavior controls whether the kubelet-auto-node-size service automatically configures
+	// GOMAXPROCS for kubelet and CRI-O system services based on the system reserved CPU allocation.
+	// Valid values are "Autosize" and "Disabled".
+	// When set to "Autosize", the GOMAXPROCS environment variable for kubelet and CRI-O is set to
+	// max(ceil(system_reserved_cpu), 1). This optimizes the runtime parallelism of these Go-based system
+	// services based on their CPU allocation rather than total node capacity.
+	// When set to "Disabled", automatic GOMAXPROCS configuration is disabled and the system services
+	// use Go's default GOMAXPROCS behavior.
+	// When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+	// The current default is "Disabled".
+	//
+	// +openshift:enable:FeatureGate=GomaxprocsInjection
+	// +optional
+	// +kubebuilder:validation:Enum=Autosize;Disabled
+	SystemGomaxprocsBehavior GomaxprocsBehaviorType `json:"systemGomaxprocsBehavior,omitempty"`
 }
 
 // KubeletConfigStatus defines the observed state of a KubeletConfig
@@ -962,6 +978,27 @@ type ContainerRuntimeConfiguration struct {
 	// +kubebuilder:validation:MaxItems=10
 	// +kubebuilder:validation:XValidation:rule="self.all(x, self.exists_one(y, x.path == y.path))",message="additionalArtifactStores must not contain duplicate paths"
 	AdditionalArtifactStores []AdditionalArtifactStore `json:"additionalArtifactStores,omitempty"`
+
+	// containerGomaxprocsBehavior controls whether CRI-O automatically injects the GOMAXPROCS environment variable into containers
+	// based on their CPU resource requests.
+	// Valid values are "Autosize" and "Disabled".
+	// When set to "Autosize", CRI-O will automatically set GOMAXPROCS proportional to the container's CPU request,
+	// calculated as max(ceil(cpu_request_in_cores * 2), 1). This helps Go applications optimize their runtime parallelism
+	// based on the allocated CPU resources rather than the total node capacity.
+	// When set to "Disabled", GOMAXPROCS injection is disabled and containers will use Go's default GOMAXPROCS behavior.
+	// When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+	// The current default is "Disabled".
+	//
+	// Containers can override the injected GOMAXPROCS value by:
+	// - Setting GOMAXPROCS in the container image Dockerfile (ENV GOMAXPROCS=...)
+	// - Setting GOMAXPROCS in the pod spec (env or envFrom)
+	// - Calling runtime.GOMAXPROCS() programmatically in Go code
+	// - Adding the skip-gomaxprocs.crio.io annotation to the pod
+	//
+	// +openshift:enable:FeatureGate=GomaxprocsInjection
+	// +optional
+	// +kubebuilder:validation:Enum=Autosize;Disabled
+	ContainerGomaxprocsBehavior GomaxprocsBehaviorType `json:"containerGomaxprocsBehavior,omitempty"`
 }
 
 type ContainerRuntimeDefaultRuntime string
@@ -974,6 +1011,16 @@ const (
 	ContainerRuntimeDefaultRuntimeDefault = ContainerRuntimeDefaultRuntimeCrun
 )
 
+// GomaxprocsBehaviorType specifies the GOMAXPROCS auto-sizing behavior
+type GomaxprocsBehaviorType string
+
+const (
+	// GomaxprocsBehaviorAutosize enables automatic GOMAXPROCS configuration
+	GomaxprocsBehaviorAutosize GomaxprocsBehaviorType = "Autosize"
+	// GomaxprocsBehaviorDisabled disables automatic GOMAXPROCS configuration
+	GomaxprocsBehaviorDisabled GomaxprocsBehaviorType = "Disabled"
+)
+
 // StorePath is an absolute filesystem path used by additional container storage configurations.
 // The path must be between 1 and 256 characters long, begin with a forward slash, and only contain
 // the characters a-z, A-Z, 0-9, '/', '.', '_', and '-'. Consecutive forward slashes are not permitted.

machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_containerruntimeconfigs-CustomNoUpgrade.crd.yaml

@@ -184,6 +184,27 @@ spec:
                     x-kubernetes-validations:
                     - message: additionalLayerStores must not contain duplicate paths
                       rule: self.all(x, self.exists_one(y, x.path == y.path))
+                  containerGomaxprocsBehavior:
+                    description: |-
+                      containerGomaxprocsBehavior controls whether CRI-O automatically injects the GOMAXPROCS environment variable into containers
+                      based on their CPU resource requests.
+                      Valid values are "Autosize" and "Disabled".
+                      When set to "Autosize", CRI-O will automatically set GOMAXPROCS proportional to the container's CPU request,
+                      calculated as max(ceil(cpu_request_in_cores * 2), 1). This helps Go applications optimize their runtime parallelism
+                      based on the allocated CPU resources rather than the total node capacity.
+                      When set to "Disabled", GOMAXPROCS injection is disabled and containers will use Go's default GOMAXPROCS behavior.
+                      When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+                      The current default is "Disabled".
+
+                      Containers can override the injected GOMAXPROCS value by:
+                      - Setting GOMAXPROCS in the container image Dockerfile (ENV GOMAXPROCS=...)
+                      - Setting GOMAXPROCS in the pod spec (env or envFrom)
+                      - Calling runtime.GOMAXPROCS() programmatically in Go code
+                      - Adding the skip-gomaxprocs.crio.io annotation to the pod
+                    enum:
+                    - Autosize
+                    - Disabled
+                    type: string
                   defaultRuntime:
                     description: |-
                       defaultRuntime is the name of the OCI runtime to be used as the default for containers.

machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_containerruntimeconfigs-DevPreviewNoUpgrade.crd.yaml

@@ -184,6 +184,27 @@ spec:
                     x-kubernetes-validations:
                     - message: additionalLayerStores must not contain duplicate paths
                       rule: self.all(x, self.exists_one(y, x.path == y.path))
+                  containerGomaxprocsBehavior:
+                    description: |-
+                      containerGomaxprocsBehavior controls whether CRI-O automatically injects the GOMAXPROCS environment variable into containers
+                      based on their CPU resource requests.
+                      Valid values are "Autosize" and "Disabled".
+                      When set to "Autosize", CRI-O will automatically set GOMAXPROCS proportional to the container's CPU request,
+                      calculated as max(ceil(cpu_request_in_cores * 2), 1). This helps Go applications optimize their runtime parallelism
+                      based on the allocated CPU resources rather than the total node capacity.
+                      When set to "Disabled", GOMAXPROCS injection is disabled and containers will use Go's default GOMAXPROCS behavior.
+                      When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+                      The current default is "Disabled".
+
+                      Containers can override the injected GOMAXPROCS value by:
+                      - Setting GOMAXPROCS in the container image Dockerfile (ENV GOMAXPROCS=...)
+                      - Setting GOMAXPROCS in the pod spec (env or envFrom)
+                      - Calling runtime.GOMAXPROCS() programmatically in Go code
+                      - Adding the skip-gomaxprocs.crio.io annotation to the pod
+                    enum:
+                    - Autosize
+                    - Disabled
+                    type: string
                   defaultRuntime:
                     description: |-
                       defaultRuntime is the name of the OCI runtime to be used as the default for containers.

machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_containerruntimeconfigs-TechPreviewNoUpgrade.crd.yaml

@@ -184,6 +184,27 @@ spec:
                     x-kubernetes-validations:
                     - message: additionalLayerStores must not contain duplicate paths
                       rule: self.all(x, self.exists_one(y, x.path == y.path))
+                  containerGomaxprocsBehavior:
+                    description: |-
+                      containerGomaxprocsBehavior controls whether CRI-O automatically injects the GOMAXPROCS environment variable into containers
+                      based on their CPU resource requests.
+                      Valid values are "Autosize" and "Disabled".
+                      When set to "Autosize", CRI-O will automatically set GOMAXPROCS proportional to the container's CPU request,
+                      calculated as max(ceil(cpu_request_in_cores * 2), 1). This helps Go applications optimize their runtime parallelism
+                      based on the allocated CPU resources rather than the total node capacity.
+                      When set to "Disabled", GOMAXPROCS injection is disabled and containers will use Go's default GOMAXPROCS behavior.
+                      When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+                      The current default is "Disabled".
+
+                      Containers can override the injected GOMAXPROCS value by:
+                      - Setting GOMAXPROCS in the container image Dockerfile (ENV GOMAXPROCS=...)
+                      - Setting GOMAXPROCS in the pod spec (env or envFrom)
+                      - Calling runtime.GOMAXPROCS() programmatically in Go code
+                      - Adding the skip-gomaxprocs.crio.io annotation to the pod
+                    enum:
+                    - Autosize
+                    - Disabled
+                    type: string
                   defaultRuntime:
                     description: |-
                       defaultRuntime is the name of the OCI runtime to be used as the default for containers.

machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-CustomNoUpgrade.crd.yaml

@@ -123,6 +123,22 @@ spec:
                     type: object
                 type: object
                 x-kubernetes-map-type: atomic
+              systemGomaxprocsBehavior:
+                description: |-
+                  systemGomaxprocsBehavior controls whether the kubelet-auto-node-size service automatically configures
+                  GOMAXPROCS for kubelet and CRI-O system services based on the system reserved CPU allocation.
+                  Valid values are "Autosize" and "Disabled".
+                  When set to "Autosize", the GOMAXPROCS environment variable for kubelet and CRI-O is set to
+                  max(ceil(system_reserved_cpu), 1). This optimizes the runtime parallelism of these Go-based system
+                  services based on their CPU allocation rather than total node capacity.
+                  When set to "Disabled", automatic GOMAXPROCS configuration is disabled and the system services
+                  use Go's default GOMAXPROCS behavior.
+                  When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+                  The current default is "Disabled".
+                enum:
+                - Autosize
+                - Disabled
+                type: string
               tlsSecurityProfile:
                 description: |-
                   tlsSecurityProfile configures TLS settings for the kubelet.

machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-DevPreviewNoUpgrade.crd.yaml

@@ -123,6 +123,22 @@ spec:
                     type: object
                 type: object
                 x-kubernetes-map-type: atomic
+              systemGomaxprocsBehavior:
+                description: |-
+                  systemGomaxprocsBehavior controls whether the kubelet-auto-node-size service automatically configures
+                  GOMAXPROCS for kubelet and CRI-O system services based on the system reserved CPU allocation.
+                  Valid values are "Autosize" and "Disabled".
+                  When set to "Autosize", the GOMAXPROCS environment variable for kubelet and CRI-O is set to
+                  max(ceil(system_reserved_cpu), 1). This optimizes the runtime parallelism of these Go-based system
+                  services based on their CPU allocation rather than total node capacity.
+                  When set to "Disabled", automatic GOMAXPROCS configuration is disabled and the system services
+                  use Go's default GOMAXPROCS behavior.
+                  When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+                  The current default is "Disabled".
+                enum:
+                - Autosize
+                - Disabled
+                type: string
               tlsSecurityProfile:
                 description: |-
                   tlsSecurityProfile configures TLS settings for the kubelet.