enable nested virt & set single process oom kill

[upodroid]

More immediate version of #8600
Fixes: #800

Before this change is applied:

• Merge cancel the per sig nodepool experiment test-infra#35741
• Create the new nodepool, taint the old ones and drop them

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: upodroid

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• infra/gcp/terraform/OWNERS [upodroid]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-infra-ci-robot]

Ran Plan for dir: infra/gcp/terraform/k8s-infra-prow-build workspace: default

Plan Error

Show Output

running 'sh -c' '/atlantis/bin/terraform1.13.4 init -input=false -upgrade' in '/atlantis/repos/kubernetes/k8s.io/8672/default/infra/gcp/terraform/k8s-infra-prow-build': exit status 1
Initializing the backend...

Successfully configured the backend "gcs"! Terraform will automatically
use this backend unless the backend configuration changes.
Upgrading modules...
Downloading registry.terraform.io/terraform-google-modules/iam/google 8.2.0 for iam...
- iam in .terraform/modules/iam/modules/projects_iam
- iam.helper in .terraform/modules/iam/modules/helper
- project in ../modules/gke-project
- prow_build_cluster in ../modules/gke-cluster
- prow_build_nodepool_c4_highmem_8_localssd in ../modules/gke-nodepool
- prow_build_nodepool_c4a_highmem_8_localssd in ../modules/gke-nodepool
- prow_build_nodepool_c4d_highmem_8_localssd in ../modules/gke-nodepool
- workload_identity_service_accounts in ../modules/workload-identity-service-account
Initializing provider plugins...
- Finding hashicorp/google versions matching ">= 3.53.0, >= 6.31.0, ~> 6.31.0, ~> 7.7.0, < 8.0.0"...
- Finding hashicorp/google-beta versions matching ">= 6.31.0, ~> 6.31.0, ~> 7.7.0"...
- Finding latest version of hashicorp/local...
- Installing hashicorp/local v2.5.3...
- Installed hashicorp/local v2.5.3 (signed by HashiCorp)
╷
│ Error: Failed to query available provider packages
│ 
│ Could not retrieve the list of available versions for provider
│ hashicorp/google: no available releases match the given constraints >=
│ 3.53.0, >= 6.31.0, ~> 6.31.0, ~> 7.7.0, < 8.0.0
│ 
│ To see which modules are currently depending on hashicorp/google and what
│ versions are specified, run the following command:
│     terraform providers
╵
╷
│ Error: Failed to query available provider packages
│ 
│ Could not retrieve the list of available versions for provider
│ hashicorp/google-beta: no available releases match the given constraints >=
│ 6.31.0, ~> 6.31.0, ~> 7.7.0
│ 
│ To see which modules are currently depending on hashicorp/google-beta and
│ what versions are specified, run the following command:
│     terraform providers
╵

[BenTheElder]

What's the use case? Nested virt can have poor performance, create noise for neighbors, and we need to make sure the VMs are not leaked ...

[upodroid]

Here is an example, trying to enable workflows like these in prow.
https://github.com/kubernetes/kops/blob/master/.github/workflows/e2e.yml

https://github.com/kubernetes/kops/actions/runs/18663330367/job/53208805245

[BenTheElder]

ACK, in kind we also use actions for this, which is mostly ~fine.

[BenTheElder]

/lgtm

[k8s-ci-robot]

New changes are detected. LGTM label has been removed.

[k8s-infra-ci-robot]

Ran Plan for dir: infra/gcp/terraform/k8s-infra-prow-build workspace: default

Show Output

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
~ update in-place

Terraform will perform the following actions:

  # google_vmwareengine_network_peering.gvce_peering will be updated in-place
~ resource "google_vmwareengine_network_peering" "gvce_peering" {
      ~ export_custom_routes_with_public_ip = false -> true
        id                                  = "projects/k8s-infra-prow-build/locations/global/networkPeerings/peer-with-gcve-project"
      ~ import_custom_routes_with_public_ip = false -> true
        name                                = "peer-with-gcve-project"
        # (13 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

• ▶️ To apply this plan, comment:

  atlantis apply -d infra/gcp/terraform/k8s-infra-prow-build

• 🚮 To delete this plan and lock, click here
• 🔁 To plan this project again, comment:

  atlantis plan -d infra/gcp/terraform/k8s-infra-prow-build

Plan: 0 to add, 1 to change, 0 to destroy.

---

• ⏩ To apply all unapplied plans from this Pull Request, comment:

  atlantis apply

• 🚮 To delete all plans and locks from this Pull Request, comment:

  atlantis unlock

[upodroid]

/hold cancel

Successfully applied