fix(delivery): share one node budget across services and tasks

scripts/release/configuration.py

@@ -20,7 +20,7 @@ PROFILES = {
     "identity": "kf_identity_operator",
     "migration": "kf_migrator",
 }
-IMPORT_CGROUP = "/sys/fs/cgroup/system.slice/kf-problem-import.service"
+IMPORT_CGROUP = "/sys/fs/cgroup/kfonlinejudge.slice/kf-problem-import.service"
 CONFIG_FILES = {
     "api.env",
     "outbox.env",
@@ -170,7 +170,7 @@ def measured_hardware() -> dict:
     value["node_scheduler"] = {}
     for label, group in (
         ("root", Path("/sys/fs/cgroup")),
-        ("system", Path("/sys/fs/cgroup/system.slice")),
+        ("node", Path("/sys/fs/cgroup/kfonlinejudge.slice")),
     ):
         value["node_scheduler"][label] = {
             name: (group / name).read_text().strip() if (group / name).exists() else None
@@ -192,7 +192,7 @@ def admission_runtime(payload: Path, data: dict) -> tuple[dict, dict]:
     admission = AdmissionRegistry.model_validate(admission).model_dump(mode="json")
     state = "/var/lib/kf-judge/images/" + data["release_id"]
     root["image_root"] = state + "/legacy-gnu"
-    root["delegated_cgroup_root"] = "/sys/fs/cgroup/kf-judge-tasks"
+    root["delegated_cgroup_root"] = "/sys/fs/cgroup/kfonlinejudge.slice/kf-judge-tasks"
     root["identities"] = {
         "worker_uid": preflight.ACCOUNTS["kf-worker"],
         "worker_gid": preflight.ACCOUNTS["kf-worker"],

scripts/release/install.py

@@ -205,6 +205,8 @@ def files(bundle: Path, expected: str) -> dict:
     for name in ("artifacts", "imports"):
         data_directory(Path("/var/lib/kf-onlinejudge") / name, preflight.ACCOUNTS["kf-oj"])
     data_directory(Path("/var/lib/kf-onlinejudge/worker"), preflight.ACCOUNTS["kf-worker"])
+    node_unit = bundle / "payload/deploy/release/kfonlinejudge.slice"
+    exclusive_file(Path("/etc/systemd/system/kfonlinejudge.slice"), node_unit.read_bytes(), 0o644)
     release = RELEASES / data["release_id"]
     if release.exists():
         preflight.protected(release, directory=True)

scripts/release/policy.py

@@ -162,7 +162,7 @@ def contract(path: Path) -> dict:
         "data": "/var/lib/kf-onlinejudge",
         "judge_configuration": "/etc/kf-judge",
         "judge_state": "/var/lib/kf-judge",
-        "task_cgroup": "/sys/fs/cgroup/kf-judge-tasks",
+        "task_cgroup": "/sys/fs/cgroup/kfonlinejudge.slice/kf-judge-tasks",
     }:
         raise DeliveryError("delivery layout mismatch")
     expected_services = {