github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-27 21:47:07 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #32383 from sttts/sttts-sysctl-infra-only

Browse Source 
Automatic merge from submit-queue

Only set sysctls for infra containers

We did set the sysctls for each container in a pod. This opens up a way to set un-whitelisted sysctls during upgrade from v1.3:
- set annotation in v1.3 with an un-whitelisted sysctl. Set restartPolicy=Always
- upgrade cluster to v1.4
- kill container process
- un-whitelisted sysctl is set on restart of the killed container.
This commit is contained in:
Kubernetes Submit Queue 2016-11-01 08:47:38 -07:00 committed by GitHub
commit 7d10cffc37
1 changed files with 13 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
pkg/kubelet/dockertools/docker_manager.go
View File

@ -688,18 +688,20 @@ func (dm *DockerManager) runContainer(
}
// Set sysctls if requested
sysctls, unsafeSysctls, err := api.SysctlsFromPodAnnotations(pod.Annotations)
if err != nil {
dm.recorder.Eventf(ref, api.EventTypeWarning, events.FailedToCreateContainer, "Failed to create docker container %q of pod %q with error: %v", container.Name, format.Pod(pod), err)
return kubecontainer.ContainerID{}, err
}
if len(sysctls)+len(unsafeSysctls) > 0 {
hc.Sysctls = make(map[string]string, len(sysctls)+len(unsafeSysctls))
for _, c := range sysctls {
hc.Sysctls[c.Name] = c.Value
if container.Name == PodInfraContainerName {
sysctls, unsafeSysctls, err := api.SysctlsFromPodAnnotations(pod.Annotations)
if err != nil {
dm.recorder.Eventf(ref, api.EventTypeWarning, events.FailedToCreateContainer, "Failed to create docker container %q of pod %q with error: %v", container.Name, format.Pod(pod), err)
return kubecontainer.ContainerID{}, err
}
for _, c := range unsafeSysctls {
hc.Sysctls[c.Name] = c.Value
if len(sysctls)+len(unsafeSysctls) > 0 {
hc.Sysctls = make(map[string]string, len(sysctls)+len(unsafeSysctls))
for _, c := range sysctls {
hc.Sysctls[c.Name] = c.Value
}
for _, c := range unsafeSysctls {
hc.Sysctls[c.Name] = c.Value
}
}
}