在运行一个容器时,有时候需要使用sysctl修改内核参数,比如net.、vm.、kernel等,sysctl需要容器拥有超级权限,容器启动时加上--privileged参数即可。那么,在k8s中是如何使用的呢?
sysctl -a可以获取sysctl所有参数列表。
从v1.4开始,kubernetes将sysctl分为safe和unsafe,其对safe的sysctl定义如下:
目前属于safe sysctl的有:
其余的都是unsafe sysctl,当kubelet支持更好的隔离机制时,safe sysctl列表将在未来的Kubernetes版本中扩展。
使用safe sysctl例子:
而使用unsafe sysctl时,需要在kubelet的启动参数中指定--experimental-allowed-unsafe-sysctls,如--experimental-allowed-unsafe-sysctls=net.core.somaxconn,具体操作如下:
编辑kubelet配置文件,修改ExecStart=/usr/bin/kubelet那一行,在后面加上--experimental-allowed-unsafe-sysctls=net.core.somaxconn,如:
ExecStart=/usr/bin/kubelet --experimental-allowed-unsafe-sysctls=net.core.somaxconn
因为我是用kubeadm安装的kubernetes,所以在/etc/systemd/system/kubelet.service.d/10-kubeadm.conf文件中加了倒数第3行内容:
[Service] Environment="KUBELET_KUBECONFIG_ARGS=--bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf" Environment="KUBELET_SYSTEM_PODS_ARGS=--pod-manifest-path=/etc/kubernetes/manifests --allow-privileged=true" Environment="KUBELET_NETWORK_ARGS=--network-plugin=cni --cni-conf-dir=/etc/cni/net.d --cni-bin-dir=/opt/cni/bin" Environment="KUBELET_DNS_ARGS=--cluster-dns=10.96.0.10 --cluster-domain=cluster.local" Environment="KUBELET_AUTHZ_ARGS=--authorization-mode=Webhook --client-ca-file=/etc/kubernetes/pki/ca.crt" Environment="KUBELET_CADVISOR_ARGS=--cadvisor-port=0" Environment="KUBELET_CGROUP_ARGS=--cgroup-driver=systemd" Environment="KUBELET_CERTIFICATE_ARGS=--rotate-certificates=true --cert-dir=/var/lib/kubelet/pki" Environment="KUBELET_EXTRA_ARGS=--experimental-allowed-unsafe-sysctls=net.core.somaxconn" ExecStart= ExecStart=/usr/bin/kubelet $KUBELET_KUBECONFIG_ARGS $KUBELET_SYSTEM_PODS_ARGS $KUBELET_NETWORK_ARGS $KUBELET_DNS_ARGS $KUBELET_AUTHZ_ARGS $KUBELET_CADVISOR_ARGS $KUBELET_CGROUP_ARGS $KUBELET_CERTIFICATE_ARGS $KUBELET_EXTRA_ARGS
重启kubelet:
systemctl daemon-reload
systemctl restart kubelet
在Pod中使用unsafe sysctl,开启privileged权限:
apiVersion: v1 kind: Pod metadata: name: sysctl-example annotations: security.alpha.kubernetes.io/unsafe-sysctls: net.core.somaxconn=65535 #使用unsafe sysctl,设置最大连接数 spec: securityContext: privileged: true #开启privileged权限 ...
参考文档地址:
https://v1-20.docs.kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/
https://blog.csdn.net/dianfu2892/article/details/101467081