fix(k3s): cap parallel image pulls

Merged
SH
3mo ago
+34-4

Summary

  • install a Kyber kubelet configuration drop-in through Home Manager
  • retain parallel pulls but cap them at four concurrent images
  • restart K3s once when either the server config or kubelet drop-in changes

Root cause addressed

K3s 1.35 generated serializeImagePulls: false without maxParallelImagePulls. During cold runtime recovery, more than 40 image downloads ran concurrently, saturated the single disk, and caused CRI deadlines, name reservations, and pull-QPS failures. Kubernetes documents maxParallelImagePulls specifically to bound network and disk consumption while retaining parallel pulls.

Validation

  • shellspec spec/activate_k3s_spec.sh (16 examples)
  • shellcheck config/k3s/activate.sh
  • make nix-format-check
  • Kyber Home Manager evaluation confirms the drop-in is present

Summary by cubic

Caps k3s image pull concurrency at 4 using a kubelet config drop-in to prevent disk saturation and CRI timeouts during cold recovery. The activation script installs the drop-in and restarts k3s once when config changes.

  • Bug Fixes
    • Add kubelet drop-in with serializeImagePulls: false and maxParallelImagePulls: 4.
    • Compare installed configs with sudo; copy server and kubelet configs only on change; restart k3s once.
    • Provision drop-in via Home Manager; add spec to assert presence; shellspec and shellcheck pass.