{"record":{"id":"b04efb8d366ab7db","repo":"containerd/containerd","slug":"failed-to-set-rdt-class-w","errorCode":null,"errorMessage":"failed to set RDT class: %w","messagePattern":"failed to set RDT class: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cri/server/container_create.go","lineNumber":860,"sourceCode":"\tsupplementalGroups := securityContext.GetSupplementalGroups()\n\n\t// Get blockio class\n\tblockIOClass, err := c.blockIOClassFromAnnotations(config.GetMetadata().GetName(), config.Annotations, sandboxConfig.Annotations)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to set blockio class: %w\", err)\n\t}\n\tif blockIOClass != \"\" {\n\t\tif linuxBlockIO, err := blockio.ClassNameToLinuxOCI(blockIOClass); err == nil {\n\t\t\tspecOpts = append(specOpts, oci.WithBlockIO(linuxBlockIO))\n\t\t} else {\n\t\t\treturn nil, err\n\t\t}\n\t}\n\n\t// Get RDT class\n\trdtClass, err := c.rdtClassFromAnnotations(config.GetMetadata().GetName(), config.Annotations, sandboxConfig.Annotations)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to set RDT class: %w\", err)\n\t}\n\tif rdtClass != \"\" {\n\t\tspecOpts = append(specOpts, oci.WithRdt(rdtClass, \"\", \"\"))\n\t}\n\n\tfor pKey, pValue := range util.GetPassthroughAnnotations(sandboxConfig.Annotations,\n\t\tociRuntime.PodAnnotations) {\n\t\tspecOpts = append(specOpts, customopts.WithAnnotation(pKey, pValue))\n\t}\n\n\tfor pKey, pValue := range util.GetPassthroughAnnotations(config.Annotations,\n\t\tociRuntime.ContainerAnnotations) {\n\t\tspecOpts = append(specOpts, customopts.WithAnnotation(pKey, pValue))\n\t}\n\n\t// Default target PID namespace is the sandbox PID.\n\ttargetPid := sandboxPid\n\t// If the container targets another container's PID namespace,","sourceCodeStart":842,"sourceCodeEnd":878,"githubUrl":"https://github.com/containerd/containerd/blob/4246446a2bf7d03837b0244118d858799393bd80/internal/cri/server/container_create.go#L842-L878","documentation":"Analogous to blockio: the CRI layer resolves an RDT (Resource Director Technology) class from container/sandbox annotations via rdtClassFromAnnotations and wraps any failure with this error during buildLinuxSpec. RDT classes map to Intel CAT/MBA allocations managed by the resctrl interface; an invalid class cannot be applied to the container.","triggerScenarios":"CreateContainer with an RDT annotation (io.containerd.cri.v0.rdt/...) whose value fails parsing or refers to a class not defined in the node's RDT configuration, or the container's pod is not in the resctrl enabled-cpuset.","commonSituations":"Pods scheduled onto nodes whose RDT config lacks the referenced class; annotation value malformed; the container's requested CPUs fall outside the resctrl schemata cpus range; kernel/hardware lacks RDT support while annotations are set.","solutions":["Ensure the node's RDT configuration (/etc/containerd/[rdt].yaml classes) contains the annotated class name","Correct the RDT annotation value in the pod spec","Verify RDT support (lscpu: RDT/CAT flags) and that the container's CPUs are within the resctrl enabled cpuset","Inspect containerd logs for the wrapped inner error from rdtClassFromAnnotations","Drop the RDT annotation if RDT is not needed"],"exampleFix":"// before\nio.containerd.cri.v0.rdt/rdt: gold-class    # not defined on node\n// after\nio.containerd.cri.v0.rdt/rdt: guaranteed    # class present in RDT config","handlingStrategy":"validation","validationCode":"const rdtKey = \"io.containerd.cri.v0.rdt/rdt\";\nconst cls = annotations?.[rdtKey];\nif (cls && !nodeRdtClasses.includes(cls)) {\n  throw new Error(`RDT class '${cls}' not defined in node RDT config`);\n}","typeGuard":"function hasValidRdtClass(a, known) {\n  const v = a?.[\"io.containerd.cri.v0.rdt/rdt\"];\n  return v === undefined || (typeof v === \"string\" && known.includes(v));\n}","tryCatchPattern":"try {\n  await createContainer(cfg);\n} catch (e) {\n  if (String(e?.message).includes(\"failed to set RDT class\")) {\n    // drop the RDT annotation and retry, or alert node-config mismatch\n  }\n  throw e;\n}","preventionTips":["Ensure RDT config on every node lists all classes referenced by workloads","Use a validating webhook to check RDT annotations against node capabilities","Verify RDT hardware/kernel support before enabling annotations cluster-wide"],"tags":["containerd","cri","rdt","annotations","kubernetes"],"backgroundTag":"rdt-class-annotation-invalid","analyzedSha":"4246446a2bf7d03837b0244118d858799393bd80","analyzedAt":"2026-09-02T00:14:43.053Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}