refactor: agent adds a disable_cgroups option

Author: TomatoMr

agent/src/config/handler.rs

@@ -205,6 +205,7 @@ pub struct EnvironmentConfig {
     pub sys_free_memory_limit: u32,
     pub log_file_size: u32,
     pub tap_mode: TapMode,
+    pub guard_interval: Duration,
     pub system_load_circuit_breaker_threshold: f32,
     pub system_load_circuit_breaker_recover: f32,
     pub system_load_circuit_breaker_metric: trident::SystemLoadMetric,
@@ -1462,6 +1463,7 @@ impl TryFrom<(Config, RuntimeConfig)> for ModuleConfig {
                 sys_free_memory_limit: conf.sys_free_memory_limit,
                 log_file_size: conf.log_file_size,
                 tap_mode: conf.tap_mode,
+                guard_interval: conf.yaml_config.guard_interval,
                 system_load_circuit_breaker_threshold: conf.system_load_circuit_breaker_threshold,
                 system_load_circuit_breaker_recover: conf.system_load_circuit_breaker_recover,
                 system_load_circuit_breaker_metric: conf.system_load_circuit_breaker_metric,

agent/src/main.rs

@@ -70,6 +70,10 @@ struct Opts {
     /// optionally `K8S_POD_IP_FOR_DEEPFLOW` can be set to override ip address.
     #[clap(long)]
     sidecar: bool,
+
+    /// Disable cgroups, deepflow-agent will default to checking the CPU and memory resource usage in a loop every 10 seconds to prevent resource usage from exceeding limits.
+    #[clap(long)]
+    disable_cgroups: bool,
 }
 
 #[cfg(unix)]
@@ -117,6 +121,7 @@ fn main() -> Result<()> {
             trident::RunningMode::Managed
         },
         opts.sidecar,
+        opts.disable_cgroups,
     )?;
     wait_on_signals();
     t.stop();

agent/src/trident.rs

@@ -242,6 +242,7 @@ impl Trident {
         version_info: &'static VersionInfo,
         agent_mode: RunningMode,
         sidecar_mode: bool,
+        disable_cgroups: bool,
     ) -> Result<Trident> {
         let config = match agent_mode {
             RunningMode::Managed => {
@@ -404,6 +405,7 @@ impl Trident {
                 exception_handler,
                 config_path,
                 sidecar_mode,
+                disable_cgroups,
                 ntp_diff,
             ) {
                 warn!(
@@ -432,6 +434,7 @@ impl Trident {
         exception_handler: ExceptionHandler,
         config_path: Option<PathBuf>,
         sidecar_mode: bool,
+        disable_cgroups: bool,
         ntp_diff: Arc<AtomicI64>,
     ) -> Result<()> {
         info!("==================== Launching DeepFlow-Agent ====================");
@@ -583,6 +586,8 @@ impl Trident {
         } else if !is_kernel_available_for_cgroups() {
             // fixme: Linux after kernel version 2.6.24 can use cgroups
             info!("don't initialize cgroups controller, because kernel version < 3 or agent is in Windows");
+        } else if disable_cgroups {
+            info!("don't initialize cgroups controller, disable cgroups, deepflow-agent will default to checking the CPU and memory resource usage in a loop every 10 seconds to prevent resource usage from exceeding limits");
         } else {
             match Cgroups::new(process::id() as u64, config_handler.environment()) {
                 Ok(cg_controller) => {
@@ -603,14 +608,14 @@ impl Trident {
         let guard = match Guard::new(
             config_handler.environment(),
             log_dir.to_string(),
-            config_handler.candidate_config.yaml_config.guard_interval,
             exception_handler.clone(),
             cgroup_mount_path,
             is_cgroup_v2,
             config_handler
                 .candidate_config
                 .yaml_config
                 .memory_trim_disabled,
+            disable_cgroups,
         ) {
             Ok(g) => g,
             Err(e) => {

agent/src/utils/guard.rs

@@ -132,7 +132,6 @@ impl SystemLoadGuard {
 pub struct Guard {
     config: EnvironmentAccess,
     log_dir: String,
-    interval: Duration,
     thread: Mutex<Option<JoinHandle<()>>>,
     running: Arc<(Mutex<bool>, Condvar)>,
     exception_handler: ExceptionHandler,
@@ -141,25 +140,25 @@ pub struct Guard {
     memory_trim_disabled: bool,
     system: Arc<Mutex<System>>,
     pid: Pid,
+    disable_cgroups: bool,
 }
 
 impl Guard {
     pub fn new(
         config: EnvironmentAccess,
         log_dir: String,
-        interval: Duration,
         exception_handler: ExceptionHandler,
         cgroup_mount_path: String,
         is_cgroup_v2: bool,
         memory_trim_disabled: bool,
+        disable_cgroups: bool,
     ) -> Result<Self, &'static str> {
         let Ok(pid) = get_current_pid() else {
             return Err("get the process' pid failed: {}, deepflow-agent restart...");
         };
         Ok(Self {
             config,
             log_dir,
-            interval,
             thread: Mutex::new(None),
             running: Arc::new((Mutex::new(false), Condvar::new())),
             exception_handler,
@@ -168,6 +167,7 @@ impl Guard {
             memory_trim_disabled,
             system: Arc::new(Mutex::new(System::new())),
             pid,
+            disable_cgroups,
         })
     }
 
@@ -326,7 +326,6 @@ impl Guard {
         let running = self.running.clone();
         let exception_handler = self.exception_handler.clone();
         let log_dir = self.log_dir.clone();
-        let interval = self.interval;
         let mut over_memory_limit = false; // Higher than the limit does not meet expectations
         let mut over_cpu_limit = false; // Higher than the limit does not meet expectations
         let mut under_sys_free_memory_limit = false; // Below the limit, it does not meet expectations
@@ -339,6 +338,7 @@ impl Guard {
         let pid: Pid = self.pid.clone();
         let cgroups_available = is_kernel_available_for_cgroups();
         let in_container = running_in_container();
+        let disable_cgroups = self.disable_cgroups;
         let mut last_exceeded = get_timestamp(0);
 
         let thread = thread::Builder::new().name("guard".to_owned()).spawn(move || {
@@ -377,7 +377,7 @@ impl Guard {
                 }
                 // If it is in a container or tap_mode is Analyzer, there is no need to limit resource, so there is no need to check cgroups
                 if !in_container && config.tap_mode != TapMode::Analyzer {
-                    if cgroups_available {
+                    if cgroups_available && !disable_cgroups {
                         if check_cgroup_result {
                             check_cgroup_result = Self::check_cgroups(cgroup_mount_path.clone(), is_cgroup_v2);
                             if !check_cgroup_result {
@@ -483,7 +483,7 @@ impl Guard {
                 if !*running {
                     break;
                 }
-                running = timer.wait_timeout(running, interval).unwrap().0;
+                running = timer.wait_timeout(running, config.guard_interval).unwrap().0;
                 if !*running {
                     break;
                 }