CMP-4340: Consolidate KubeletConfig remediations for eviction threshold rules

[abushkin-redhat]

Description:

The fix consolidates each rule's multiple KubeletConfig objects into a single object in all 10 kubernetes/shared.yml files under applications/openshift/kubelet/kubelet_eviction_thresholds_set_*/. This produces 1 ComplianceRemediation per rule instead of 2-3, resulting in a single MCO rollout that completes successfully. Validated on OCP 4.22 CI / RHEL 10 with all 10 soft eviction remediations applied to both master and worker nodes -- all 6 nodes survived and all rules pass after rescan. An additional copy-paste bug was fixed in kubelet_eviction_thresholds_set_soft_nodefs_available/rule.yml where xccdf_variable: var_event_record_qps (from a different rule) was replaced with the correct values block.

[abushkin-redhat]

/ok-to-test

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

kubernetes remediation for rule 'xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_hard_imagefs_available' differs.
--- xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_hard_imagefs_available
+++ xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_hard_imagefs_available
@@ -5,9 +5,4 @@
   kubeletConfig:
     evictionHard:
       imagefs.available: {{.var_kubelet_evictionhard_imagefs_available}}
----
-apiVersion: machineconfiguration.openshift.io/v1
-kind: KubeletConfig
-spec:
-  kubeletConfig:
     evictionPressureTransitionPeriod: 0s

kubernetes remediation for rule 'xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_hard_imagefs_inodesfree' differs.
--- xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_hard_imagefs_inodesfree
+++ xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_hard_imagefs_inodesfree
@@ -5,9 +5,4 @@
   kubeletConfig:
     evictionHard:
       imagefs.inodesFree: {{.var_kubelet_evictionhard_imagefs_inodesfree}}
----
-apiVersion: machineconfiguration.openshift.io/v1
-kind: KubeletConfig
-spec:
-  kubeletConfig:
     evictionPressureTransitionPeriod: 0s

kubernetes remediation for rule 'xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_hard_memory_available' differs.
--- xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_hard_memory_available
+++ xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_hard_memory_available
@@ -5,9 +5,4 @@
   kubeletConfig:
     evictionHard:
       memory.available: {{.var_kubelet_evictionhard_memory_available}}
----
-apiVersion: machineconfiguration.openshift.io/v1
-kind: KubeletConfig
-spec:
-  kubeletConfig:
     evictionPressureTransitionPeriod: 0s

kubernetes remediation for rule 'xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_hard_nodefs_available' differs.
--- xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_hard_nodefs_available
+++ xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_hard_nodefs_available
@@ -5,9 +5,4 @@
   kubeletConfig:
     evictionHard:
       nodefs.available: {{.var_kubelet_evictionhard_nodefs_available}}
----
-apiVersion: machineconfiguration.openshift.io/v1
-kind: KubeletConfig
-spec:
-  kubeletConfig:
     evictionPressureTransitionPeriod: 0s

kubernetes remediation for rule 'xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_hard_nodefs_inodesfree' differs.
--- xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_hard_nodefs_inodesfree
+++ xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_hard_nodefs_inodesfree
@@ -5,9 +5,4 @@
   kubeletConfig:
     evictionHard:
       nodefs.inodesFree: {{.var_kubelet_evictionhard_nodefs_inodesfree}}
----
-apiVersion: machineconfiguration.openshift.io/v1
-kind: KubeletConfig
-spec:
-  kubeletConfig:
     evictionPressureTransitionPeriod: 0s

kubernetes remediation for rule 'xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_soft_imagefs_available' differs.
--- xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_soft_imagefs_available
+++ xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_soft_imagefs_available
@@ -5,16 +5,6 @@
   kubeletConfig:
     evictionSoft:
       imagefs.available: {{.var_kubelet_evictionsoft_imagefs_available}}
----
-apiVersion: machineconfiguration.openshift.io/v1
-kind: KubeletConfig
-spec:
-  kubeletConfig:
     evictionSoftGracePeriod:
       imagefs.available: "1m30s"
----
-apiVersion: machineconfiguration.openshift.io/v1
-kind: KubeletConfig
-spec:
-  kubeletConfig:
     evictionPressureTransitionPeriod: 0s

kubernetes remediation for rule 'xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_soft_imagefs_inodesfree' differs.
--- xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_soft_imagefs_inodesfree
+++ xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_soft_imagefs_inodesfree
@@ -5,16 +5,6 @@
   kubeletConfig:
     evictionSoft:
       imagefs.inodesFree: {{.var_kubelet_evictionsoft_imagefs_inodesfree}}
----
-apiVersion: machineconfiguration.openshift.io/v1
-kind: KubeletConfig
-spec:
-  kubeletConfig:
     evictionSoftGracePeriod:
       imagefs.inodesFree: "1m30s"
----
-apiVersion: machineconfiguration.openshift.io/v1
-kind: KubeletConfig
-spec:
-  kubeletConfig:
     evictionPressureTransitionPeriod: 0s

kubernetes remediation for rule 'xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_soft_memory_available' differs.
--- xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_soft_memory_available
+++ xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_soft_memory_available
@@ -5,16 +5,6 @@
   kubeletConfig:
     evictionSoft:
       memory.available: {{.var_kubelet_evictionsoft_memory_available}}
----
-apiVersion: machineconfiguration.openshift.io/v1
-kind: KubeletConfig
-spec:
-  kubeletConfig:
     evictionSoftGracePeriod:
       memory.available: "1m30s"
----
-apiVersion: machineconfiguration.openshift.io/v1
-kind: KubeletConfig
-spec:
-  kubeletConfig:
     evictionPressureTransitionPeriod: 0s

kubernetes remediation for rule 'xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_soft_nodefs_available' differs.
--- xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_soft_nodefs_available
+++ xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_soft_nodefs_available
@@ -5,16 +5,6 @@
   kubeletConfig:
     evictionSoft:
       nodefs.available: {{.var_kubelet_evictionsoft_nodefs_available}}
----
-apiVersion: machineconfiguration.openshift.io/v1
-kind: KubeletConfig
-spec:
-  kubeletConfig:
     evictionSoftGracePeriod:
       nodefs.available: "1m30s"
----
-apiVersion: machineconfiguration.openshift.io/v1
-kind: KubeletConfig
-spec:
-  kubeletConfig:
     evictionPressureTransitionPeriod: 0s

kubernetes remediation for rule 'xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_soft_nodefs_inodesfree' differs.
--- xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_soft_nodefs_inodesfree
+++ xccdf_org.ssgproject.content_rule_kubelet_eviction_thresholds_set_soft_nodefs_inodesfree
@@ -5,16 +5,6 @@
   kubeletConfig:
     evictionSoft:
       nodefs.inodesFree: {{.var_kubelet_evictionsoft_nodefs_inodesfree}}
----
-apiVersion: machineconfiguration.openshift.io/v1
-kind: KubeletConfig
-spec:
-  kubeletConfig:
     evictionSoftGracePeriod:
       nodefs.inodesFree: "1m30s"
----
-apiVersion: machineconfiguration.openshift.io/v1
-kind: KubeletConfig
-spec:
-  kubeletConfig:
     evictionPressureTransitionPeriod: 0s

[openshift-ci]

@abushkin-redhat: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-node-compliance	6a6b079	link	true	/test e2e-aws-openshift-node-compliance
ci/prow/e2e-aws-openshift-platform-compliance	6a6b079	link	true	/test e2e-aws-openshift-platform-compliance

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.