K3s agent fails on OAK-4D due to cgroup v1 — how to enable cgroup v2?

sym00

Hi,

I’m trying to run a K3s agent on an OAK-4D device.
The agent can successfully connect to the server (CA retrieval and proxy connection both work), but kubelet exits with the following error:
Error: failed to validate kubelet configuration, error: kubelet is configured to not run on a host using cgroup v1. cgroup v1 support is unsupported and will be removed in a future release

Question

What is the recommended way to migrate the device to cgroup v2?

Environment

Device: OAK-4D
OS: Luxonis OS RVC4 1.32.1

cgroup mounts result

# mount | grep cgroup
tmpfs on /sys/fs/cgroup type tmpfs (ro,nosuid,nodev,noexec,seclabel,size=4096k,nr_inodes=1024,mode=755)
cgroup2 on /sys/fs/cgroup/unified type cgroup2 (rw,nosuid,nodev,noexec,relatime,seclabel,nsdelegate)
cgroup on /sys/fs/cgroup/systemd type cgroup (rw,nosuid,nodev,noexec,relatime,seclabel,xattr,name=systemd)
cgroup on /sys/fs/cgroup/memory type cgroup (rw,nosuid,nodev,noexec,relatime,seclabel,memory)
cgroup on /sys/fs/cgroup/pids type cgroup (rw,nosuid,nodev,noexec,relatime,seclabel,pids)
cgroup on /sys/fs/cgroup/net_cls,net_prio type cgroup (rw,nosuid,nodev,noexec,relatime,seclabel,net_cls,net_prio)
cgroup on /sys/fs/cgroup/cpuset type cgroup (rw,nosuid,nodev,noexec,relatime,seclabel,cpuset)
cgroup on /sys/fs/cgroup/cpu,cpuacct type cgroup (rw,nosuid,nodev,noexec,relatime,seclabel,cpu,cpuacct)
cgroup on /sys/fs/cgroup/blkio type cgroup (rw,nosuid,nodev,noexec,relatime,seclabel,blkio)
cgroup on /sys/fs/cgroup/devices type cgroup (rw,nosuid,nodev,noexec,relatime,seclabel,devices)
cgroup on /sys/fs/cgroup/freezer type cgroup (rw,nosuid,nodev,noexec,relatime,seclabel,freezer)

This appears to be a hybrid cgroup layout, not unified cgroup v2.

sym00

If using k3s is not an option in OAK environment, are there any other recommended container orchestration tools?

OskarSonc

Hey sym00 - the error indicates the device is still on a hybrid / cgroup v1 layout, not pure cgroup v2, and at the moment we don’t have a documented/supported way to switch OAK-4D / Luxonis OS to unified cgroup v2 manually.

However try to first update to the latest Luxonis OS(since there were some updates about this) and re-check with:

stat -fc %T /sys/fs/cgroup/

For OAK4, the recommended deployment path is oakctl / Luxonis Hub containerized apps; if you need Kubernetes, the better setup is to run K3s on an external edge host and manage the OAK-4D as a connected device.

Thanks,
Oskar

sym00

Hi @OskarSonc ,

Thanks for your response.

Here is my environment and I believe the OS is latest one.
And I know there are some imporvements for k3s in 1.29.2, so I tried k3s.

~ # cat /etc/os-release
ID=luxonisos-rvc4
NAME="Luxonis OS RVC4"
VERSION="1.32.1"
VERSION_ID=r851-1.32.1
PRETTY_NAME="Luxonis OS RVC4 1.32.1"
IMAGE_REV="46b5d64b5badcdf18c9343125cc7f1089491960e"
MANIFEST_REV_REV="125ac13"
BUILD_ID="20260518182345"
~ # stat -fc %T /sys/fs/cgroup/
tmpfs

I’m already familiar with oakctl and Luxonis Hub, but my understanding is that they currently do not allow running multiple independent containers simultaneously on the same device. From my use case, I need to orchestrate multiple containers, which is why I was exploring Kubernetes-based approaches.

Regarding cgroup v2, would it be technically difficult to support it on Luxonis OS? If it is feasible, I would be very interested in this feature and would like to submit it as a feature request.

OskarSonc

sym00 - thanks for providing more info...
Will sumbit it to dev team!

Thanks,
Oskar