Add support for setting sysctl values in podman play kube manifests

[fpoirotte]

Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)

/kind feature

Description

Please add support for securityContext.sysctls.name / securityContext.sysctls.value in podman play kube.
More information on the associated syntax can be found at https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#setting-sysctls-for-a-pod

Steps to reproduce the issue:

1. Create sysctl.yaml with the following content:

apiVersion: v1
kind: Pod
metadata:
  name: sysctl
spec:
  restartPolicy: Never

  securityContext:
    sysctls:
    - name:  net.ipv4.icmp_echo_ignore_broadcasts
      value: 0

  containers:
  - name: alpine
    image: alpine:3.15
    command: ["/bin/sleep", "300"]

2. Start the pod using that file: podman play kube sysctl.yaml and wait for the command's completion.

3. In a new terminal, run podman exec -i sysctl-alpine sysctl net.ipv4.icmp_echo_ignore_broadcasts

Describe the results you received:
net.ipv4.icmp_echo_ignore_broadcasts = 1

Describe the results you expected:
net.ipv4.icmp_echo_ignore_broadcasts = 0

Additional information you deem important (e.g. issue happens only occasionally):

podman supports overriding (a subset of) sysctl settings when running a container (through podman run --sysctl name=value).
Running the same test with podman run gives the expected result:

$ podman run --name sysctl-ctr -d --rm --sysctl net.ipv4.icmp_echo_ignore_broadcasts=0 alpine:3.15 sleep 300 && podman exec -i sysctl-ctr sysctl net.ipv4.icmp_echo_ignore_broadcasts
7b0a282c4e53e25e135cb8ce441c7886936ee03c58840955a255cd1a00adbfc7
net.ipv4.icmp_echo_ignore_broadcasts = 0

Output of podman version:

Client:       Podman Engine
Version:      4.3.1
API Version:  4.3.1
Go Version:   go1.18.7
Built:        Fri Nov 11 16:24:13 2022
OS/Arch:      linux/amd64

Output of podman info:

host:
  arch: amd64
  buildahVersion: 1.28.0
  cgroupControllers:
  - cpu
  - io
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon-2.1.4-3.fc36.x86_64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.4, commit: '
  cpuUtilization:
    idlePercent: 53.19
    systemPercent: 11.94
    userPercent: 34.87
  cpus: 8
  distribution:
    distribution: fedora
    variant: workstation
    version: "36"
  eventLogger: file
  hostname: myhost
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1501
      size: 1
    - container_id: 1
      host_id: 7000000
      size: 8665536
    uidmap:
    - container_id: 0
      host_id: 1234
      size: 1
    - container_id: 1
      host_id: 7000000
      size: 8665536
  kernel: 6.0.7-200.fc36.x86_64
  linkmode: dynamic
  logDriver: k8s-file
  memFree: 4573777920
  memTotal: 16622600192
  networkBackend: cni
  ociRuntime:
    name: crun
    package: crun-1.6-2.fc36.x86_64
    path: /usr/bin/crun
    version: |-
      crun version 1.6
      commit: 18cf2efbb8feb2b2f20e316520e0fd0b6c41ef4d
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL
  os: linux
  remoteSocket:
    exists: true
    path: /run/user/1234/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: true
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns-1.2.0-0.2.beta.0.fc36.x86_64
    version: |-
      slirp4netns version 1.2.0-beta.0
      commit: 477db14a24ff1a3de3a705e51ca2c4c1fe3dda64
      libslirp: 4.6.1
      SLIRP_CONFIG_VERSION_MAX: 3
      libseccomp: 2.5.3
  swapFree: 12448526336
  swapTotal: 17179860992
  uptime: 261h 38m 27.00s (Approximately 10.88 days)
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  search:
  - registry.fedoraproject.org
  - registry.access.redhat.com
  - docker.io
  - quay.io
store:
  configFile: /home/me/.config/containers/storage.conf
  containerStore:
    number: 3
    paused: 0
    running: 0
    stopped: 3
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /home/me/.local/share/containers/storage
  graphRootAllocated: 229198450688
  graphRootUsed: 181539045376
  graphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 420
  runRoot: /run/user/1234/containers
  volumePath: /home/me/.local/share/containers/storage/volumes
version:
  APIVersion: 4.3.1
  Built: 1668180253
  BuiltTime: Fri Nov 11 16:24:13 2022
  GitCommit: ""
  GoVersion: go1.18.7
  Os: linux
  OsArch: linux/amd64
  Version: 4.3.1

Package info (e.g. output of rpm -q podman or apt list podman or brew info podman):

podman-4.3.1-1.fc36.x86_64

Have you tested with the latest version of Podman and have you checked the Podman Troubleshooting Guide?

Yes

Additional environment details (AWS, VirtualBox, physical, etc.):

physical environment

[github-actions]

A friendly reminder that this issue had no activity for 30 days.

[jwillikers]

This would be great!

[rhatdan]

Anyone interested in opening a PR?

[hasan4791]

I'll take a look at this one
/assign

[hasan4791]

    securityContext:
      sysctls:
      - name:  net.ipv4.icmp_echo_ignore_broadcasts
        value: 0

Looks like, these configurations should go inside pod spec rather than container spec.

https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#podsecuritycontext-v1-core
https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#securitycontext-v1-core

[ygalblum]

Actually it may be configured at both levels: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

[hasan4791]

Actually it may be configured at both levels: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

SecurityContext is configured at both levels, but the sysctl configuration is defined in podsecuritycontext.

[fpoirotte]

Indeed, only the pod's securityContext can be used to set sysctl settings.
I've updated my initial post to reflect that.
Thanks again for pointing that out!