Adding in the current work on the sysctl changes for elastic.
This MR is for discussion purposes. After doing some research and reading several things came out.
-
We cannot change the value "vm.max_map_count=262144" using sysctls for a couple of reasons. First, we are trying to block those via Gatekeeper policies. Secondly, the vm.max_map_count would need to be added to the unsafe sysctls list when creating the cluster or have the cluster modified after install. None of which can be done via sysctls.
-
Changing via the init container (which requires elevated privileges) requires us to elevate the privileges for the entire pod. There is currently only one way to give an init container a different set of privileges than the rest of the pod and that involves getting a token manually and assigning that token via a securitycontext.
-
I finally settled on using a DaemonSet that has its own set of privs and can be locked down from any outside access. That is what is included in this MR.