UNCLASSIFIED - NO CUI

Skip to content

Adding in the current work on the sysctl changes for elastic.

Eric Goode requested to merge sysctls-for-elastic into main

This MR is for discussion purposes. After doing some research and reading several things came out.

  1. We cannot change the value "vm.max_map_count=262144" using sysctls for a couple of reasons. First, we are trying to block those via Gatekeeper policies. Secondly, the vm.max_map_count would need to be added to the unsafe sysctls list when creating the cluster or have the cluster modified after install. None of which can be done via sysctls.

  2. Changing via the init container (which requires elevated privileges) requires us to elevate the privileges for the entire pod. There is currently only one way to give an init container a different set of privileges than the rest of the pod and that involves getting a token manually and assigning that token via a securitycontext.

  3. I finally settled on using a DaemonSet that has its own set of privs and can be locked down from any outside access. That is what is included in this MR.

Merge request reports