External-Mirrors/kubespray
2
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-10-31 14:36:20 -02:30
Code Issues Packages Projects Releases Wiki Activity

preinstall: generalize minimum-value semantics for managed sysctls (#13224)

Browse Source 
* preinstall: generalize minimum-value semantics for managed sysctls

Move the hardcoded sysctl floor map out of 0080-system-configurations.yml
into a default variable, and introduce additional_sysctl_min so users can
declare their own sysctl floors. Floor semantics only apply a managed
value when the node's current value is lower; pre-tuned images (Bottlerocket,
EKS AMIs, OpenShift RHCOS, hardened distros) and newer kernels that
already set higher values are left alone.

Default floors are aligned with prior art from the OpenShift Node Tuning
Operator (TuneD '=>' floor syntax in the openshift / openshift-node
profiles) and kops. None of the floor keys are part of the kubelet
protect-kernel-defaults validation list, so the floor mechanism cannot
interfere with kubelet startup. Keys not present on the running
kernel/distro are skipped without failing.

additional_sysctl (exact-value semantics) is unchanged for backward
compatibility.

Signed-off-by: Kay Yan <kay.yan@daocloud.io>

* preinstall: refine sysctl floor handling

Keep built-in floor values internal while preserving user overrides
through additional_sysctl_min.

Use sysctl --ignore for unknown keys and filter empty results without
masking other read errors.

Signed-off-by: Kay Yan <kay.yan@daocloud.io>

---------

Signed-off-by: Kay Yan <kay.yan@daocloud.io>
This commit is contained in:
Kay Yan
2026-09-10 07:46:33 +00:00
committed by GitHub
parent 35f900dd72
commit b7d99749b8
4 changed files with 61 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/kubespray_defaults/vars/main/main.yml
+21
View File
@@ -20,6 +20,27 @@ etcd_supported_versions:
kube_proxy_deployed: "{{ 'addon/kube-proxy' not in kubeadm_init_phases_skip }}"
# Sysctl floors: only applied when the node's current value is lower than
# the desired one, so pre-tuned images and newer kernels are not regressed.
# Values are aligned with OpenShift Node Tuning Operator and kops, and
# are outside the kubelet protect-kernel-defaults validation list.
sysctl_minimum_values:
fs.inotify.max_user_instances: 8192
fs.inotify.max_user_watches: 65536
kernel.pid_max: 4194304
fs.aio-max-nr: 1048576
vm.max_map_count: 262144
net.netfilter.nf_conntrack_max: 1048576
net.core.somaxconn: 32768
net.core.netdev_max_backlog: 16384
fs.file-max: 2097152
net.ipv4.neigh.default.gc_thresh1: 8192
net.ipv4.neigh.default.gc_thresh2: 32768
net.ipv4.neigh.default.gc_thresh3: 65536
net.ipv6.neigh.default.gc_thresh1: 8192
net.ipv6.neigh.default.gc_thresh2: 32768
net.ipv6.neigh.default.gc_thresh3: 65536
# The lowest version allowed to upgrade from (same as calico_version in the previous branch)
calico_min_version_required: "3.27.0"