Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[FEAT] Support sysctl configurations from Pod Spec #17464

Merged
merged 1 commit into from
Feb 17, 2023
Merged

[FEAT] Support sysctl configurations from Pod Spec #17464

merged 1 commit into from
Feb 17, 2023

Conversation

hasan4791
Copy link
Contributor

@hasan4791 hasan4791 commented Feb 10, 2023 •
edited by Luap99
Loading

Signed-off-by: T K Chandra Hasan [email protected]

Fixes: #16711

Does this PR introduce a user-facing change?

Yes

Support sysctl options from Pod Spec via podman kube play CLI

@openshift-ci openshift-ci bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. do-not-merge/release-note-label-needed Enforce release-note requirement, even if just None labels Feb 10, 2023
@rhatdan
Copy link
Member

rhatdan commented Feb 10, 2023

Can you add a test? Start a pod and then inspect the container to make sure the sysctl is set.

@hasan4791
Copy link
Contributor Author

@rhatdan Yes, working on it.

@hasan4791
Copy link
Contributor Author

I have a query regarding the implementation. If i set the sysctl while creating the pod, its not updating. But if i set the same while creating containers, its working fine. I feel like this should be working when the infracontainer is created!!
Please correct me if i'm wrong.

@hasan4791
Copy link
Contributor Author

@Luap99 PTAL at my above query.

@hasan4791
Copy link
Contributor Author

NVM, figured it out :) It should be with infracontainers.

@hasan4791 hasan4791 changed the title [WIP] [FEAT] Support sysctl configurations from Pod Spec [FEAT] Support sysctl configurations from Pod Spec Feb 16, 2023
@openshift-ci openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Feb 16, 2023
@hasan4791 hasan4791 force-pushed the issue-16711 branch 2 times, most recently from c1adc52 to bdf4076 Compare February 16, 2023 11:47
@hasan4791
Support sysctl configs via podman kube play
94d4b52 
Support sysctl configuration from Pod spec via podman kube play CLI

Closes containers#16711

Signed-off-by: T K Chandra Hasan <[email protected]>
vrothberg
vrothberg reviewed Feb 17, 2023
View reviewed changes
Copy link
Member

@vrothberg vrothberg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code LGTM

@umohnani8 PTAL

@vrothberg
Copy link
Member

Thanks for contributing, @hasan4791 !

Luap99
Luap99 reviewed Feb 17, 2023
View reviewed changes
test/e2e/play_kube_test.go
Comment on lines +5096 to +5104
It("podman play kube test with sysctl & host network defined", func() {
SkipIfRootless("Network sysctls are not available for rootless")
err := writeYaml(podWithSysctlHostNetDefined, kubeYaml)
Expect(err).ToNot(HaveOccurred())

kube := podmanTest.Podman([]string{"play", "kube", kubeYaml})
kube.WaitWithDefaultTimeout()
Expect(kube).Should(Exit(125))
})
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Doesn't this test change the somaxconn value on the host, thus effecting all systems where this was run permanently? Tests should not change host behaviour. AFAIK having such a high value can be abused to create a DOS attack against the machine.
I recommend to use a safer sysctl for this test.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This testcase is to check the failure. We cannot set sysctl when host network is enabled.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh wait, right. sorry

Luap99
Luap99 approved these changes Feb 17, 2023
View reviewed changes
Copy link
Member

@Luap99 Luap99 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Feb 17, 2023
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Feb 17, 2023

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: hasan4791, Luap99

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added approved Indicates a PR has been approved by an approver from all required OWNERS files. release-note and removed do-not-merge/release-note-label-needed Enforce release-note requirement, even if just None labels Feb 17, 2023
@openshift-merge-robot openshift-merge-robot merged commit f9af496 into containers:main Feb 17, 2023
@hasan4791 hasan4791 deleted the issue-16711 branch February 17, 2023 10:49
@wehagy wehagy mentioned this pull request Aug 26, 2023
Merged
@github-actions github-actions bot added the locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. label Sep 9, 2023
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Sep 9, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@vrothberg vrothberg vrothberg left review comments

@Luap99 Luap99 Luap99 approved these changes

Assignees

@Luap99 Luap99

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. release-note
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Add support for setting sysctl values in podman play kube manifests
5 participants
@hasan4791 @rhatdan @vrothberg @Luap99 @openshift-merge-robot