cri: set default RLIMIT_NOFILE

[zmrow]

Issue number:
Related to #1136

Description of changes:

The `cri` plugin currently inherits the limit from the default OCI spec or the
containerd process.  This change sets the default RLIMIT_NOFILE to 1048576 in
the OCI spec for any container spawned using `cri`.

The intent is to upstream this patch, but there is additional work to be done to make it compatible with containerd >1.3. We also don't have some of the upstream unit tests in our containerd package; we'll need to write one for this change when we submit upstream.

Given that the AL2 AMI uses this limit, albeit on the containerd process, it seems a reasonable number to use for container processes spawned by cri.

Testing done:
Ran a busybox pod on a Bottlerocket AMI built using this patch:

~/bottlerocket/bottlerocket $ kubectl run -i -t busybox --image=busybox --restart=Never                                                  
If you don't see a command prompt, try pressing enter.
/ # ulimit -a
...
open files                      (-n) 65536
...

Ran a busybox pod on the latest released Bottlerocket AMI:

~/bottlerocket/bottlerocket $ kubectl run -i -t busybox --image=busybox --restart=Never
If you don't see a command prompt, try pressing enter.
/ # ulimit -a
...
open files                      (-n) 1073741816
...

Ran the MySQL manifest from #1136 with an AMI built using this patch and confirmed the pod runs just fine without any OOM issues that I could see. (I also ran the pod with the current released Bottlerocket AMI and confirmed that it does indeed OOM)

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

[samuelkarp]

Code looks good to me, just one question about what the value should be.

[webern]

Wow, nice job.

[zmrow]

^ added a soft limit of 65536 and confirmed this is what the node sees.

open files                      (-n) 65536

[zmrow]

I ran the MySQL manifest from #1136 with an AMI built using this patch and confirmed the pod runs just fine without any OOM issues that I could see. (I also ran the pod with the current released Bottlerocket AMI and confirmed that it does indeed OOM)

apiVersion: v1
kind: Pod
metadata:
  name: mysql-test
  namespace: default
spec:
  containers:
    - name: mysql
      imagePullPolicy: Always
      image: 'mysql:5.7'
      env:
        - name: MYSQL_DATABASE
          value: test
        - name: MYSQL_ROOT_PASSWORD
          value: test

[zmrow]

^ the above force push fixes up the spacing issues @bcressey caught

(Thanks :set list !)