NO_FILE ulimit still seems to be different to v1.4.1

[scrayos]

Bug Report

Description

The bug that was described here seems to be still present to some degree. At least the NO_FILE behavior seems to be still different to the behavior in Talos Linux v1.4.1.

I've deployed sonarqube in my cluster and (aside from the database) this setup only involves a single Pod (that is part of a Statefulset). The pod uses a busybox container to set the required sysctls and ulimits for sonarqube/elasticsearch.

But it seems like those changes will no longer be present in the other container (sonarqube). The script in the init-container looks like this:

if [[ "$(sysctl -n vm.max_map_count)" -lt 524288 ]]; then
  sysctl -w vm.max_map_count=524288
fi
if [[ "$(sysctl -n fs.file-max)" -lt 131072 ]]; then
  sysctl -w fs.file-max=131072
fi
if [[ "$(ulimit -n)" != "unlimited" ]]; then
  if [[ "$(ulimit -n)" -lt 131072 ]]; then
    echo "ulimit -n 131072"
    ulimit -n 131072
  fi
fi
if [[ "$(ulimit -u)" != "unlimited" ]]; then
  if [[ "$(ulimit -u)" -lt 8192 ]]; then
    echo "ulimit -u 8192"
    ulimit -u 8192
  fi
fi

but the output of ulimit -a in the sonarqube container is (notice open files = 1024):

core file size          (blocks, -c) 0
data seg size           (kbytes, -d) unlimited
scheduling priority             (-e) 0
file size               (blocks, -f) unlimited
pending signals                 (-i) 256511
max locked memory       (kbytes, -l) 8192
max memory size         (kbytes, -m) unlimited
open files                      (-n) 1024
pipe size            (512 bytes, -p) 8
POSIX message queues     (bytes, -q) 819200
real-time priority              (-r) 0
stack size              (kbytes, -s) 8192
cpu time               (seconds, -t) unlimited
max user processes              (-u) 256511
virtual memory          (kbytes, -v) unlimited
file locks                      (-x) unlimited

I've changed nothing but the Talos version and this pod is no longer working, failing with a message, that is saying, that max files is not high enough. So it seems that now changes to sysctl for NO_FILES in other containers won't affect the rest of the Pod anymore.

Environment

• Talos version: 1.4.3
• Kubernetes version:
  Client Version: v1.27.1
  Kustomize Version: v5.0.1
  Server Version: v1.27.1
• Platform: Hetzner Cloud/Bare Metal

[frezbo]

Yes, the bug is still not resolved, we're looking into it