This repository has been archived by the owner on Oct 24, 2023. It is now read-only.
chore(CIS): add protect-kernel-defaults #999
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
/azp run pr-e2e |
|
Azure Pipelines successfully started running 1 pipeline(s). |
Codecov Report
@@ Coverage Diff @@
## master #999 +/- ##
==========================================
+ Coverage 74.43% 74.43% +<.01%
==========================================
Files 131 131
Lines 18318 18319 +1
==========================================
+ Hits 13635 13636 +1
Misses 3902 3902
Partials 781 781 |
|
it looks like this flag would make kubelet down: /hold |
This comment has been minimized.
This comment has been minimized.
andyzhangx
changed the title
|
/hold |
andyzhangx
changed the title
|
Interesting thing:
That's the reason why this PR always failed. |
|
@cchildress @khenidak @cpuguy83 Any thoughts on changing the host OS setting |
andyzhangx
force-pushed
the
cis-protect-kernel-defaults
branch
from
f74dfa3 to
83014d0
Compare
|
Thanks guys, I have figured out that I should set kernel turnable falgs before set up kubelet, it works now. |
andyzhangx
changed the title
|
/hold cancel |
|
@andyzhangx I've moved bits around here:
I'd still like a review from one of @cchildress @khenidak @cpuguy83 @weinong @yangl900 before merging |
CecileRobertMichon
added
the
needs-rebase
andyzhangx
force-pushed
the
cis-protect-kernel-defaults
branch
from
1c88f15 to
f5a3008
Compare
andyzhangx
commented
Apr 25, 2019
| net.ipv6.conf.default.accept_redirects = 0 | ||
| # refer to https://github.com/kubernetes/kubernetes/blob/75d45bdfc9eeda15fb550e00da662c12d7d37985/pkg/kubelet/cm/container_manager_linux.go#L359-L397 | ||
| vm.overcommit_memory = 1 |
There was a problem hiding this comment.
@jackfrancis I found this code change will fail all e2e test, and actully the kernel flags are not set correctly after this PR:
Failed to start ContainerManager [Invalid kernel flag: kernel/panic, expected value: 10, actual value: 0, Invalid kernel flag: kernel/panic_on_oops, expected value: 1, actual value: 0, Invalid kernel flag: vm/overcommit_memory, expected value: 1, actual value: 0]
There is also no /etc/sysctl.d/60-CIS.conf file under /etc/sysctl.d/
There was a problem hiding this comment.
Addressed by putting the whole thing behind "if ubuntu distro" only logic. Once the changes in this file are baked into the VHD then we can turn the functionality on, and run tests, by default
|
@andyzhangx, we haven't baked this new config file into a VHD yet, so we need to verify this functionality by using the "ubuntu" distro. I've just made a change to do that, and validated that it works: |
|
Validated new E2E test coverage on "ubuntu" distro: |
|
/azp run pr-e2e |
|
Azure Pipelines successfully started running 1 pipeline(s). |
mboersma
removed
the
needs-rebase
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: andyzhangx, mboersma The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
andyzhangx
commented
Apr 29, 2019
| @@ -81,6 +81,12 @@ func (cs *ContainerService) setKubeletConfig() { | |||
| "--streaming-connection-idle-timeout": "5m", | |||
| } | |||
|
|
|||
| // "--protect-kernel-defaults" is true is currently only valid using base Ubuntu OS image | |||
| // until the changes are baked into a VHD | |||
| if cs.Properties.IsUbuntuDistroForAllNodes() { | |||
There was a problem hiding this comment.
It looks like it will always return false now @jackfrancis
// IsUbuntuDistroForAllNodes returns true if all of the agent pools plus masters are running the base Ubuntu image
func (p *Properties) IsUbuntuDistroForAllNodes() bool {
if len(p.AgentPoolProfiles) > 0 {
for _, ap := range p.AgentPoolProfiles {
if ap.Distro != Ubuntu && ap.Distro != Ubuntu1804 {
return false
}
}
}
if p.MasterProfile != nil {
return p.MasterProfile.Distro == Ubuntu || p.MasterProfile.Distro == Ubuntu1804
}
return true
}
I think I have already tried the latest Ubuntu version:
"agentpoolosImageSKU": {
"value": "aks-ubuntu-1604-201904"
},
"agentpoolosImageVersion": {
"value": "2019.04.24"
},
4 tasks
4 tasks
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Reason for Change:
fix: add protect-kernel-defaults for CIS conformance
about
protect-kernel-defaults: Default kubelet behaviour for kernel tuning. If set, kubelet errors if any of kernel tunables is different than kubelet defaults.Issue Fixed:
Fixes #446
Requirements:
Notes:
/assign @jackfrancis @CecileRobertMichon
cc @feiskyer