Error: Flag --allowed-unsafe-sysctls has been deprecated

user_14174628 0
Viewed 3713

I'm trying to execute on the node kubelet --allowed-unsafe-sysctls 'net.core.somaxconn'

but return Flag --allowed-unsafe-sysctls has been deprecated, This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.

I also tried using PodSecurityPolicy, but it still doesn't work

apiVersion: v1
kind: PodSecurityPolicy
metadata:
  name: sysctl-psp
spec:
  sysctls:
    - net.*
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  runAsUser:
    rule: RunAsAny
  fsGroup:
    rule: RunAsAny

I received the following error: forbidden sysctl: "net.core.somaxconn" not whitelisted

yaml detailed:

apiVersion: v1
kind: Pod
metadata:
  name: sysctl-example
spec:
  securityContext:
    sysctls:
      - name: net.core.somaxconn
        value: "65535"
        unsafe: true
  containers:
    - image: tomcat
      name: tomcat
kubelet kubernetes
1 Answers

As the error suggests, You need to start the Kubelet with the --config flag which sets the path of the Kubelet's config file. The Kubelet will then load its config from this file.

You can write the config file by yourself or generate it by KubeletConfiguration object.

Sample YAML:

apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
allowedUnsafeSysctls:
- "net.core.somaxconn"

Follow this doc - Set Kubelet parameters via a config file

user_110320440
Related