kubelet: clamp cpu shares to max allowed

clamp the max cpu.shares to the maximum value allowed by the kernel.

It is not an issue when using cgroupfs, as the kernel will
anyway make sure the value is not out of range and automatically clamp
it, systemd has an additional check that prevents the cgroup creation.

Closes: kubernetes#92855

Signed-off-by: Giuseppe Scrivano <[email protected]>

Author: giuseppe

pkg/kubelet/cm/helpers_linux.go

@@ -38,8 +38,11 @@ import (
 )
 
 const (
-	// Taken from lmctfy https://github.com/google/lmctfy/blob/master/lmctfy/controllers/cpu_controller.cc
-	MinShares     = 2
+	// These limits are defined in the kernel:
+	// https://github.com/torvalds/linux/blob/0bddd227f3dc55975e2b8dfa7fc6f959b062a2c7/kernel/sched/sched.h#L427-L428
+	MinShares = 2
+	MaxShares = 262144
+
 	SharesPerCPU  = 1024
 	MilliCPUToCPU = 1000
 
@@ -88,6 +91,9 @@ func MilliCPUToShares(milliCPU int64) uint64 {
 	if shares < MinShares {
 		return MinShares
 	}
+	if shares > MaxShares {
+		return MaxShares
+	}
 	return uint64(shares)
 }