How to Allow Unsafe Sysctls on a PMK Cluster

sudo systemctl stop pf9-{hostagent,nodeletd}

# kubectl get configmap master-default-kubelet-config  -n kube-system -o yaml

...

    allowedUnsafeSysctls:

    - "kernel.msg*"

    - "net.core.somaxconn"

sudo systemctl start pf9-hostagent

# cat pod.yaml

apiVersion: v1

kind: Pod

metadata:

  name: nginx

spec:

  securityContext:

    sysctls:

    - name: kernel.shm_rmid_forced

      value: "0"

    - name: net.core.somaxconn

      value: "1024"

    - name: kernel.msgmax

      value: "65536"

  containers:

  - name: nginx

    image: nginx

    imagePullPolicy: IfNotPresent

# kubectl get pods

NAME    READY   STATUS    RESTARTS   AGE

nginx   1/1     Running   0          67s

# kubectl get pods

NAME    READY   STATUS            RESTARTS   AGE

nginx   0/1     SysctlForbidden   0          13s

​

# kubectl describe pod nginx

Events:

  Type     Reason           Age        From                     Message

  ----     ------           ----       ----                     -------

  Normal   Scheduled        <unknown>                           Successfully assigned default/nginx to 10.128.146.164

  Warning  SysctlForbidden  27s        kubelet, 10.128.146.164  forbidden sysctl: "net.core.somaxconn" not whitelisted