External-Mirrors/kubespray
2
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-10-31 06:26:19 -02:30
Code Issues Packages Projects Releases Wiki Activity

preinstall: generalize minimum-value semantics for managed sysctls (#13224)

Browse Source 
* preinstall: generalize minimum-value semantics for managed sysctls

Move the hardcoded sysctl floor map out of 0080-system-configurations.yml
into a default variable, and introduce additional_sysctl_min so users can
declare their own sysctl floors. Floor semantics only apply a managed
value when the node's current value is lower; pre-tuned images (Bottlerocket,
EKS AMIs, OpenShift RHCOS, hardened distros) and newer kernels that
already set higher values are left alone.

Default floors are aligned with prior art from the OpenShift Node Tuning
Operator (TuneD '=>' floor syntax in the openshift / openshift-node
profiles) and kops. None of the floor keys are part of the kubelet
protect-kernel-defaults validation list, so the floor mechanism cannot
interfere with kubelet startup. Keys not present on the running
kernel/distro are skipped without failing.

additional_sysctl (exact-value semantics) is unchanged for backward
compatibility.

Signed-off-by: Kay Yan <kay.yan@daocloud.io>

* preinstall: refine sysctl floor handling

Keep built-in floor values internal while preserving user overrides
through additional_sysctl_min.

Use sysctl --ignore for unknown keys and filter empty results without
masking other read errors.

Signed-off-by: Kay Yan <kay.yan@daocloud.io>

---------

Signed-off-by: Kay Yan <kay.yan@daocloud.io>
This commit is contained in:
Kay Yan
2026-09-10 07:46:33 +00:00
committed by GitHub
parent 35f900dd72
commit b7d99749b8
4 changed files with 61 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/kubespray_defaults/defaults/main/main.yml
+12 -1
View File
@@ -620,10 +620,21 @@ kubelet_protect_kernel_defaults: true
# Set additional sysctl variables to modify Linux kernel variables, for example:
# additional_sysctl:
# - { name: kernel.pid_max, value: 131072 }
# - { name: vm.swappiness, value: 10 }
#
# `additional_sysctl` uses exact-value semantics. For floor semantics
# (only apply when the node's current value is lower), use
# `additional_sysctl_min` below.
additional_sysctl: []
# User-defined sysctl floors, merged on top of the built-in floor values
# (user values take precedence). Set a key to 0 to disable a default floor.
# Example:
# additional_sysctl_min:
# net.core.somaxconn: 65535
# kernel.pid_max: 0
additional_sysctl_min: {}
## List of key=value pairs that describe feature gates for
## the k8s cluster.
kube_feature_gates: []