External-Mirrors/kubespray
2
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-10-31 14:36:20 -02:30
Code Issues Packages Projects Releases Wiki Activity

preinstall: generalize minimum-value semantics for managed sysctls (#13224)

Browse Source 
* preinstall: generalize minimum-value semantics for managed sysctls

Move the hardcoded sysctl floor map out of 0080-system-configurations.yml
into a default variable, and introduce additional_sysctl_min so users can
declare their own sysctl floors. Floor semantics only apply a managed
value when the node's current value is lower; pre-tuned images (Bottlerocket,
EKS AMIs, OpenShift RHCOS, hardened distros) and newer kernels that
already set higher values are left alone.

Default floors are aligned with prior art from the OpenShift Node Tuning
Operator (TuneD '=>' floor syntax in the openshift / openshift-node
profiles) and kops. None of the floor keys are part of the kubelet
protect-kernel-defaults validation list, so the floor mechanism cannot
interfere with kubelet startup. Keys not present on the running
kernel/distro are skipped without failing.

additional_sysctl (exact-value semantics) is unchanged for backward
compatibility.

Signed-off-by: Kay Yan <kay.yan@daocloud.io>

* preinstall: refine sysctl floor handling

Keep built-in floor values internal while preserving user overrides
through additional_sysctl_min.

Use sysctl --ignore for unknown keys and filter empty results without
masking other read errors.

Signed-off-by: Kay Yan <kay.yan@daocloud.io>

---------

Signed-off-by: Kay Yan <kay.yan@daocloud.io>
This commit is contained in:
Kay Yan
2026-09-10 07:46:33 +00:00
committed by GitHub
parent 35f900dd72
commit b7d99749b8
4 changed files with 61 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/operations/large-deployments.md
+17
View File
@@ -50,3 +50,20 @@ For a large scaled deployments, consider the following configuration changes:
For example, when deploying 200 nodes, you may want to run ansible with
``--forks=50``, ``--timeout=600`` and define the ``retry_stagger: 60``.
Sysctl tuning with floor semantics
----------------------------------
Built-in sysctl floors are only applied when the node's current value is
lower, so pre-tuned images and newer kernels are left alone. Use
`additional_sysctl_min` to add or override floors (set a key to `0` to
disable a default); use `additional_sysctl` for exact-value semantics.
```yaml
additional_sysctl_min:
net.core.somaxconn: 65535
kernel.pid_max: 0
```
See `roles/kubespray_defaults/vars/main/main.yml` for the built-in floor
set.