kubernetes: kubelet_reserved drop-in 30-reserved.conf and a k3s restart handler that runs only with k3s_restart_allowed

kubernetes/defaults/main.yml

@@ -40,10 +40,18 @@ kubernetes:
   # when this is set and differs; empty installs the latest when k3s is missing.
   version: ""
 
-  # KubeletConfiguration fields (systemReserved, evictionHard, ...) written to
+  # KubeletConfiguration fields (evictionHard, evictionSoft, ...) written to
   # /etc/rancher/k3s/kubelet.conf.d/20-memory.conf; empty writes no file
   kubelet_memory: {}
 
+  # KubeletConfiguration fields systemReserved and kubeReserved written to
+  # /etc/rancher/k3s/kubelet.conf.d/30-reserved.conf; empty writes no file.
+  # Both only shrink the allocatable of the node (enforceNodeAllocatable stays
+  # pods). Sized per node in host_vars from the measured memory and CPU of
+  # k3s.service (kubeReserved) and of everything else outside kubepods.slice
+  # (systemReserved).
+  kubelet_reserved: {}
+
   # Extra config of the nodes running etcd, left out with disable-etcd
   etcd_config_extra:
     # Without it etcd serves metrics on 127.0.0.1 only, out of reach of vmagent