Give system.slice and the k3s unit CPUWeight 1000 so the control plane wins CPU against pods

kubernetes/tasks/cpu_weight.yml

@@ -0,0 +1,36 @@
+# kubelet gives kubepods.slice a cpu.weight from its allocatable CPUs (313 on
+# 8 cores), while system.slice and k3s.service keep the default 100. Under load
+# the pods then outweigh etcd, apiserver and kubelet. Weight 1000 lets the
+# control plane win that contention.
+- name: Set the CPUWeight of system.slice and the k3s unit
+  vars:
+    k3s_unit: "{{ 'k3s' if type == 'server' else 'k3s-agent' }}.service"
+  block:
+    - name: Create the drop-in directories
+      ansible.builtin.file:
+        path: "/etc/systemd/system/{{ item }}.d"
+        state: directory
+        mode: "0755"
+      loop:
+        - system.slice
+        - "{{ k3s_unit }}"
+
+    - name: Write the CPUWeight drop-ins
+      ansible.builtin.copy:
+        dest: "/etc/systemd/system/{{ item.unit }}.d/50-cpu-weight.conf"
+        mode: "0644"
+        content: |
+          [{{ item.section }}]
+          CPUWeight=1000
+      loop:
+        - unit: system.slice
+          section: Slice
+        - unit: "{{ k3s_unit }}"
+          section: Service
+      register: cpu_weight
+
+    # Only daemon-reload: the weight applies to the running k3s unit without a restart
+    - name: Reload systemd for the CPUWeight drop-ins
+      ansible.builtin.systemd_service:
+        daemon_reload: true
+      when: cpu_weight is changed

kubernetes/tasks/main.yml

@@ -2,5 +2,8 @@
 
 - import_tasks: ./node.yml
 
+- import_tasks: ./cpu_weight.yml
+  tags: cpu_weight
+
 - import_tasks: ./install.yml
   when: target_host is not defined or inventory_hostname == target_host