feat(nvidia-tuned): change containerd drop to be a script

ayuskauskas · ayuskauskas · commit d32bbea45fb9 · 2026-03-06T10:10:31.000-08:00
feat(nvidia-tuned): update so final profile is {service}-{accelerator}-{intent}
diff --git a/nvidia-tuned/profiles/os/common/nvidia-gb200-performance/containerd_service.sh b/nvidia-tuned/profiles/os/common/nvidia-gb200-performance/containerd_service.sh
@@ -0,0 +1,59 @@
+#!/bin/bash
+# TuneD script plugin lifecycle: start | stop [full_rollback] | verify [ignore_missing]
+# https://github.com/redhat-performance/tuned/blob/v2.21.0/tuned/plugins/plugin_script.py
+
+set -e
+
+DROPIN_DIR=/etc/systemd/system/containerd.service.d
+DROPIN_FILE=containerd.conf
+EXPECTED_CONTENT='[Service]
+LimitSTACK=67108864
+'
+
+apply_dropin() {
+	mkdir -p "$DROPIN_DIR"
+	cat <<EOF > "$DROPIN_DIR/$DROPIN_FILE"
+[Service]
+LimitSTACK=67108864
+EOF
+	systemctl daemon-reload
+}
+
+remove_dropin() {
+	rm -f "$DROPIN_DIR/$DROPIN_FILE"
+	if [ -d "$DROPIN_DIR" ] && [ -z "$(ls -A "$DROPIN_DIR" 2>/dev/null)" ]; then
+		rmdir "$DROPIN_DIR"
+	fi
+	systemctl daemon-reload
+}
+
+verify_dropin() {
+	local ignore_missing=false
+	[ "${2:-}" = "ignore_missing" ] && ignore_missing=true
+
+	if [ ! -f "$DROPIN_DIR/$DROPIN_FILE" ]; then
+		$ignore_missing && exit 0 || exit 1
+	fi
+	if [ "$(cat "$DROPIN_DIR/$DROPIN_FILE")" != "$EXPECTED_CONTENT" ]; then
+		exit 1
+	fi
+	exit 0
+}
+
+cmd="${1:-}"
+case "$cmd" in
+	start)
+		apply_dropin
+		;;
+	stop)
+		remove_dropin
+		# full_rollback (arg 2) - same unapply for this script
+		;;
+	verify)
+		verify_dropin "$@"
+		;;
+	*)
+		echo "Usage: $0 start | stop [full_rollback] | verify [ignore_missing]" >&2
+		exit 1
+		;;
+esac
diff --git a/nvidia-tuned/profiles/os/common/nvidia-gb200-performance/tuned.conf b/nvidia-tuned/profiles/os/common/nvidia-gb200-performance/tuned.conf
@@ -23,5 +23,6 @@ vm.max_map_count=262144
 vm.min_free_kbytes=65536
 vm.overcommit_memory=1
 
-[service]
-service.containerd=start,enable,file:/etc/tuned/nvidia-gb200-performance/service_containerd.conf
+[script]
+# Workaround for tuned not working if the dropin folder already exists
+script=${i:PROFILE_DIR}/containerd_service.sh
diff --git a/nvidia-tuned/skyhook_dir/prepare_nvidia_profiles.sh b/nvidia-tuned/skyhook_dir/prepare_nvidia_profiles.sh
@@ -18,10 +18,11 @@
 
 # Prepares NVIDIA tuned profiles by:
 # 1. Reading intent, accelerator, and service from configmap
-# 2. Constructing the profile name as nvidia-{accelerator}-{intent}
-# 3. Copying common base profiles to /usr/lib/tuned/
-# 4. Selecting the appropriate OS-specific workload profiles
-# 5. Setting up the service profile with dynamic include
+# 2. Constructing the workload profile name as nvidia-{accelerator}-{intent}
+# 3. Final profile name: {service}-{accelerator}-{intent} when service is set, else workload profile name
+# 4. Copying common base profiles to /usr/lib/tuned/
+# 5. Selecting the appropriate OS-specific workload profiles
+# 6. Setting up the service profile with dynamic include
 
 set -xe
 set -u
@@ -132,10 +133,23 @@ validate_profile() {
     echo "Validated profile exists: $profile"
 }
 
-# Deploy service profile with dynamic include
+# Build the final profile name: {service}-{accelerator}-{intent} when service is set
+build_final_profile_name() {
+    local service=$1
+    local accelerator=$2
+    local intent=$3
+    if [ -n "$service" ]; then
+        echo "${service}-${accelerator}-${intent}"
+    else
+        echo "nvidia-${accelerator}-${intent}"
+    fi
+}
+
+# Deploy service profile with dynamic include (into directory named {service}-{accelerator}-{intent})
 deploy_service_profile() {
     local service=$1
     local profile=$2
+    local final_profile_name=$3
     local service_dir="$PROFILES_DIR/service/$service"
 
     if [ ! -d "$service_dir" ]; then
@@ -158,15 +172,15 @@ deploy_service_profile() {
         local profile_to_include="$profile"
     fi
 
-    # Create service profile directory
-    mkdir -p "$TUNED_USER_DIR/$service"
+    # Create service profile directory (final profile name = {service}-{accelerator}-{intent})
+    mkdir -p "$TUNED_USER_DIR/$final_profile_name"
 
     # Copy template and inject include line
     local template="$service_dir/tuned.conf.template"
     if [ -f "$template" ]; then
         # Insert include= line after [main]
-        sed "s/^\[main\]/[main]\ninclude=$profile_to_include/" "$template" | tee "$TUNED_USER_DIR/$service/tuned.conf" > /dev/null
-        echo "Created service profile: $service with include=$profile_to_include"
+        sed "s/^\[main\]/[main]\ninclude=$profile_to_include/" "$template" | tee "$TUNED_USER_DIR/$final_profile_name/tuned.conf" > /dev/null
+        echo "Created service profile: $final_profile_name with include=$profile_to_include"
     else
         echo "ERROR: Service template not found: $template"
         exit 1
@@ -178,8 +192,8 @@ deploy_service_profile() {
         filename=$(basename "$file")
         [ "$filename" = "tuned.conf.template" ] && continue
         [[ "$filename" == *.conf ]] && continue  # Skip .conf files (they're service-specific profiles)
-        cp "$file" "$TUNED_USER_DIR/$service/$filename"
-        chmod +x "$TUNED_USER_DIR/$service/$filename" 2>/dev/null || true
+        cp "$file" "$TUNED_USER_DIR/$final_profile_name/$filename"
+        chmod +x "$TUNED_USER_DIR/$final_profile_name/$filename" 2>/dev/null || true
         echo "Copied service file: $filename"
     done
 }
@@ -247,9 +261,10 @@ main() {
         SERVICE=$(cat "$SERVICE_FILE" | xargs)
         if [ -n "$SERVICE" ]; then
             echo "Requested service: $SERVICE"
-            deploy_service_profile "$SERVICE" "$PROFILE"
-            # Active profile is the service (which includes the workload profile)
-            write_tuned_profile "$SERVICE"
+            FINAL_PROFILE=$(build_final_profile_name "$SERVICE" "$ACCELERATOR" "$INTENT")
+            echo "Final profile name: $FINAL_PROFILE (service=$SERVICE, accelerator=$ACCELERATOR, intent=$INTENT)"
+            deploy_service_profile "$SERVICE" "$PROFILE" "$FINAL_PROFILE"
+            write_tuned_profile "$FINAL_PROFILE"
         else
             # No service, use workload profile directly
             write_tuned_profile "$PROFILE"
diff --git a/nvidia-tuned/skyhook_dir/prepare_nvidia_profiles_check.sh b/nvidia-tuned/skyhook_dir/prepare_nvidia_profiles_check.sh
@@ -31,13 +31,25 @@ ACCELERATOR_FILE="$CONFIGMAP_DIR/accelerator"
 SERVICE_FILE="$CONFIGMAP_DIR/service"
 TUNED_PROFILE_FILE="$CONFIGMAP_DIR/tuned_profile"
 
-# Build the profile name from configmap fields
+# Build the workload profile name from configmap fields
 build_profile_name() {
     local intent=$1
     local accelerator=$2
     echo "nvidia-${accelerator}-${intent}"
 }
 
+# Build the final profile name: {service}-{accelerator}-{intent} when service is set
+build_final_profile_name() {
+    local service=$1
+    local accelerator=$2
+    local intent=$3
+    if [ -n "$service" ]; then
+        echo "${service}-${accelerator}-${intent}"
+    else
+        echo "nvidia-${accelerator}-${intent}"
+    fi
+}
+
 # Verify common profiles are deployed
 verify_common_profiles() {
     echo "Verifying common profiles in $TUNED_SYSTEM_DIR..."
@@ -125,31 +137,31 @@ verify_constructed_profile() {
     echo "Verified constructed profile: $profile"
 }
 
-# Verify service profile is deployed with correct include
+# Verify service profile is deployed with correct include (final profile name = {service}-{accelerator}-{intent})
 verify_service_profile() {
-    local service=$1
-    local expected_profile=$2
+    local final_profile_name=$1
+    local expected_workload_profile=$2
 
-    if [ ! -d "$TUNED_USER_DIR/$service" ]; then
-        echo "ERROR: Service profile directory missing: $TUNED_USER_DIR/$service"
+    if [ ! -d "$TUNED_USER_DIR/$final_profile_name" ]; then
+        echo "ERROR: Service profile directory missing: $TUNED_USER_DIR/$final_profile_name"
         exit 1
     fi
 
-    local service_conf="$TUNED_USER_DIR/$service/tuned.conf"
+    local service_conf="$TUNED_USER_DIR/$final_profile_name/tuned.conf"
     if [ ! -f "$service_conf" ]; then
-        echo "ERROR: tuned.conf missing for service profile: $service"
+        echo "ERROR: tuned.conf missing for service profile: $final_profile_name"
         exit 1
     fi
 
-    # Verify include line points to correct profile
-    if ! grep -q "^include=$expected_profile" "$service_conf"; then
-        echo "ERROR: Service profile $service does not include $expected_profile"
+    # Verify include line points to workload profile
+    if ! grep -q "^include=$expected_workload_profile" "$service_conf"; then
+        echo "ERROR: Service profile $final_profile_name does not include $expected_workload_profile"
         echo "Contents of $service_conf:"
         cat "$service_conf"
         exit 1
     fi
 
-    echo "Verified service profile: $service includes $expected_profile"
+    echo "Verified service profile: $final_profile_name includes $expected_workload_profile"
 }
 
 # Verify tuned_profile file exists and is correct
@@ -206,10 +218,10 @@ main() {
     if [ -f "$SERVICE_FILE" ]; then
         SERVICE=$(cat "$SERVICE_FILE" | xargs)
         if [ -n "$SERVICE" ]; then
-            # Verify service profile
-            verify_service_profile "$SERVICE" "$PROFILE"
-            # Expected active profile is the service
-            verify_tuned_profile_file "$SERVICE"
+            FINAL_PROFILE=$(build_final_profile_name "$SERVICE" "$ACCELERATOR" "$INTENT")
+            # Verify service profile (final name = {service}-{accelerator}-{intent})
+            verify_service_profile "$FINAL_PROFILE" "$PROFILE"
+            verify_tuned_profile_file "$FINAL_PROFILE"
         else
             # No service, active profile is the workload profile
             verify_tuned_profile_file "$PROFILE"
