preinstall: generalize minimum-value semantics for managed sysctls (#13224)

* preinstall: generalize minimum-value semantics for managed sysctls

Move the hardcoded sysctl floor map out of 0080-system-configurations.yml
into a default variable, and introduce additional_sysctl_min so users can
declare their own sysctl floors. Floor semantics only apply a managed
value when the node's current value is lower; pre-tuned images (Bottlerocket,
EKS AMIs, OpenShift RHCOS, hardened distros) and newer kernels that
already set higher values are left alone.

Default floors are aligned with prior art from the OpenShift Node Tuning
Operator (TuneD '=>' floor syntax in the openshift / openshift-node
profiles) and kops. None of the floor keys are part of the kubelet
protect-kernel-defaults validation list, so the floor mechanism cannot
interfere with kubelet startup. Keys not present on the running
kernel/distro are skipped without failing.

additional_sysctl (exact-value semantics) is unchanged for backward
compatibility.

Signed-off-by: Kay Yan <kay.yan@daocloud.io>

* preinstall: refine sysctl floor handling

Keep built-in floor values internal while preserving user overrides
through additional_sysctl_min.

Use sysctl --ignore for unknown keys and filter empty results without
masking other read errors.

Signed-off-by: Kay Yan <kay.yan@daocloud.io>

---------

Signed-off-by: Kay Yan <kay.yan@daocloud.io>

roles/kubernetes/preinstall/tasks/0080-system-configurations.yml

@@ -125,17 +125,18 @@
     - { name: vm.panic_on_oom, value: 0 }
   when: kubelet_protect_kernel_defaults | bool
 
-- name: Read current sysctl values
-  command: sysctl -n {{ item.key }}
+- name: Compute effective sysctl minimum values (defaults + user overrides)
+  set_fact:
+    _sysctl_minimum_values_effective: "{{ sysctl_minimum_values | combine(additional_sysctl_min) }}"
+
+- name: Read current sysctl values for floor-managed keys
+  command: sysctl --ignore -n {{ item.key }}
   register: sysctl_settings
   changed_when: false
-  vars:
-    # For integer sysctls only
-    sysctl_minimum_values:
-      fs.inotify.max_user_instances: 8192
-  loop: "{{ sysctl_minimum_values | dict2items }}"
+  check_mode: false  # read-only; must run under --check so later loop has rc/stdout
+  loop: "{{ _sysctl_minimum_values_effective | dict2items }}"
 
-- name: Increase sysctl value if lower than minimum
+- name: Increase sysctl value if lower than configured minimum
   ansible.posix.sysctl:
     sysctl_file: "{{ sysctl_file_path }}"
     name: "{{ item.item.key }}"
@@ -143,8 +144,8 @@
     state: present
     reload: true
     ignoreerrors: "{{ sysctl_ignore_unknown_keys }}"
-  when: item.stdout | int < item.item.value
-  loop: "{{ sysctl_settings.results }}"
+  when: item.stdout | int < item.item.value | int
+  loop: "{{ sysctl_settings.results | selectattr('stdout') }}"
 
 - name: Check dummy module
   community.general.modprobe: