kubelet failed to find mountpoint for CPU

I’m using kubeadm 1.15.3, docker-ce 18.09 on Debian 10 buster 5.2.9-2, and seeing errors in journalctl -xe | grep kubelet:

server.go:273] failed to run Kubelet: mountpoint for cpu not found

My /sys/fs/cgroup contains:

-r--r--r--  1 root root 0 Sep  2 18:49 cgroup.controllers
-rw-r--r--  1 root root 0 Sep  2 18:50 cgroup.max.depth
-rw-r--r--  1 root root 0 Sep  2 18:50 cgroup.max.descendants
-rw-r--r--  1 root root 0 Sep  2 18:49 cgroup.procs
-r--r--r--  1 root root 0 Sep  2 18:50 cgroup.stat
-rw-r--r--  1 root root 0 Sep  2 18:49 cgroup.subtree_control
-rw-r--r--  1 root root 0 Sep  2 18:50 cgroup.threads
-rw-r--r--  1 root root 0 Sep  2 18:50 cpu.pressure
-r--r--r--  1 root root 0 Sep  2 18:50 cpuset.cpus.effective
-r--r--r--  1 root root 0 Sep  2 18:50 cpuset.mems.effective
drwxr-xr-x  2 root root 0 Sep  2 18:49 init.scope
-rw-r--r--  1 root root 0 Sep  2 18:50 io.pressure
-rw-r--r--  1 root root 0 Sep  2 18:50 memory.pressure
drwxr-xr-x 20 root root 0 Sep  2 18:49 system.slice
drwxr-xr-x  2 root root 0 Sep  2 18:49 user.slice

docker.service is running okay and has /etc/docker/daemon.json:

{
  "exec-opts": [
    "native.cgroupdriver=systemd"
  ],
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "100m"
  },
  "storage-driver": "overlay2"
}

The kubeadm docs say if using docker the cgroup driver will be autodetected, but I tried supplying it anyway for good measure – no change.

With mount or cgroupfs-mount:

$ mount -t cgroup -o all cgroup /sys/fs/cgroup
mount: /sys/fs/cgroup: cgroup already mounted on /sys/fs/cgroup/cpuset.
$ cgroupfs-mount
mount: /sys/fs/cgroup/cpu: cgroup already mounted on /sys/fs/cgroup/cpuset.
mount: /sys/fs/cgroup/blkio: cgroup already mounted on /sys/fs/cgroup/cpuset.
mount: /sys/fs/cgroup/memory: cgroup already mounted on /sys/fs/cgroup/cpuset.
mount: /sys/fs/cgroup/pids: cgroup already mounted on /sys/fs/cgroup/cpuset.

Is the problem that it’s at cpuset rather than cpu? I tried to create a symlink, but root does not have write permission for /sys/fs/cgroup. (Presumably I can change it, but I took that as enough warning not to meddle.)

How can let kubelet find my CPU cgroup mount?

Source: StackOverflow