github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-19 18:02:01 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #116792 from pacoxu/fix-safe-sysctl-windows

Browse Source 
safe-sysctl: skip checking for windows
This commit is contained in:
Kubernetes Prow Robot 2023-03-21 17:39:59 -07:00 committed by GitHub
commit 9c6414cdfe
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 32 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

59
pkg/kubelet/sysctl/safe_sysctls.go
View File

@ -17,11 +17,15 @@ limitations under the License.
package sysctl
import (
"fmt"
goruntime "runtime"
"k8s.io/apimachinery/pkg/util/version"
"k8s.io/klog/v2"
"k8s.io/kubernetes/pkg/proxy/ipvs"
)
// refer to https://github.com/torvalds/linux/commit/122ff243f5f104194750ecbc76d5946dd1eec934.
const ipLocalReservedPortsMinNamespacedKernelVersion = "3.16"
var safeSysctls = []string{
@ -32,28 +36,7 @@ var safeSysctls = []string{
"net.ipv4.ip_unprivileged_port_start",
}
// SafeSysctlAllowlist returns the allowlist of safe sysctls and safe sysctl patterns (ending in *).
//
// A sysctl is called safe iff
// - it is namespaced in the container or the pod
// - it is isolated, i.e. has no influence on any other pod on the same node.
func SafeSysctlAllowlist() []string {
kernelVersionStr, err := ipvs.NewLinuxKernelHandler().GetKernelVersion()
if err != nil {
klog.ErrorS(err, "Failed to get kernel version.")
return safeSysctls
}
kernelVersion, err := version.ParseGeneric(kernelVersionStr)
if err != nil {
klog.ErrorS(err, "Failed to parse kernel version.")
return safeSysctls
}
// ip_local_reserved_ports has been changed to namesapced since kernel v3.16.
// refer to https://github.com/torvalds/linux/commit/122ff243f5f104194750ecbc76d5946dd1eec934.
if kernelVersion.LessThan(version.MustParseGeneric(ipLocalReservedPortsMinNamespacedKernelVersion)) {
return safeSysctls
}
return []string{
var safeSysctlsIncludeReservedPorts = []string{
"kernel.shm_rmid_forced",
"net.ipv4.ip_local_port_range",
"net.ipv4.tcp_syncookies",
@ -61,4 +44,36 @@ func SafeSysctlAllowlist() []string {
"net.ipv4.ip_unprivileged_port_start",
"net.ipv4.ip_local_reserved_ports",
}
// SafeSysctlAllowlist returns the allowlist of safe sysctls and safe sysctl patterns (ending in *).
//
// A sysctl is called safe iff
// - it is namespaced in the container or the pod
// - it is isolated, i.e. has no influence on any other pod on the same node.
func SafeSysctlAllowlist() []string {
if goruntime.GOOS == "linux" {
// make sure we're on a new enough kernel that the ip_local_reserved_ports sysctl is namespaced
kernelVersion, err := getKernelVersion()
if err != nil {
klog.ErrorS(err, "Failed to get kernel version, dropping net.ipv4.ip_local_reserved_ports from safe sysctl list")
return safeSysctls
}
if kernelVersion.LessThan(version.MustParseGeneric(ipLocalReservedPortsMinNamespacedKernelVersion)) {
klog.ErrorS(nil, "Kernel version is too old, dropping net.ipv4.ip_local_reserved_ports from safe sysctl list", "kernelVersion", kernelVersion)
return safeSysctls
}
}
return safeSysctlsIncludeReservedPorts
}
func getKernelVersion() (*version.Version, error) {
kernelVersionStr, err := ipvs.NewLinuxKernelHandler().GetKernelVersion()
if err != nil {
return nil, fmt.Errorf("failed to get kernel version: %w", err)
}
kernelVersion, err := version.ParseGeneric(kernelVersionStr)
if err != nil {
return nil, fmt.Errorf("failed to parse kernel version: %w", err)
}
return kernelVersion, nil
}