<p>I was trying to run <code>kubelet parameters add --feature-gates=ReadOnlyAPIDataVolumes=false</code> on my GKE node with node version 1.9.7.</p>

<p>Then I got the following error:</p>

<pre><code>I1002 00:56:53.617596   13469 feature_gate.go:226] feature gates: &amp;{{} map[ReadOnlyAPIDataVolumes:false]}
I1002 00:56:53.617724   13469 controller.go:114] kubelet config controller: starting controller
I1002 00:56:53.617729   13469 controller.go:118] kubelet config controller: validating combination of defaults and flags
error: error reading /var/lib/kubelet/pki/kubelet.key, certificate and key must be supplied as a pair
</code></pre>

<p>If I run <code>sudo kubelet parameters add --feature-gates=ReadOnlyAPIDataVolumes=false</code>, then I got </p>

<pre><code>error: unrecognized key: ReadOnlyAPIDataVolumes
</code></pre>

<p>My questions:</p>

<ul>
<li>In general, should kubelet command be executed from as root or not?</li>
<li>Specifically how to run "kubelet parameters add" command successfully?</li>
</ul>

<ol>
<li><p>Yes. Although it may be possible to run as <code>non-root</code>, the kubelet has control over so many different components on your system that would be difficult to make it talk to all the components as <code>non-root</code>.</p></li>
<li><p>I'm really not sure where <code>kubelet parameters add</code> comes from, or how it's setup on GKE (I believe it's the good old <code>kube-up.sh</code> script) But generally, you can change your kubelet parameters at the <code>systemd</code> level. For example, I use kubeadm and change/add flags in <code>/var/lib/kubelet/kubeadm-flags.env</code> or just inline on the kubelet command line, according to this <code>systemd</code> service definition:</p>

<pre><code>$ systemctl cat kubelet
# /lib/systemd/system/kubelet.service
[Unit]
Description=kubelet: The Kubernetes Node Agent
Documentation=https://kubernetes.io/docs/home/

[Service]
ExecStart=/usr/bin/kubelet
Restart=always
StartLimitInterval=0
RestartSec=10

[Install]
WantedBy=multi-user.target

# /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
# Note: This dropin only works with kubeadm and kubelet v1.11+
[Service]
Environment="KUBELET_KUBECONFIG_ARGS=--bootstrap- kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf --hostname-override=ip-x-x-x-x.us-east-1.compute.internal"
Environment="KUBELET_CONFIG_ARGS=--config=/var/lib/kubelet/config.yaml"
# This is a file that "kubeadm init" and "kubeadm join" generates at runtime, populating the KUBELET_KUBEADM_ARGS variable dynamically
EnvironmentFile=-/var/lib/kubelet/kubeadm-flags.env
# This is a file that the user can use for overrides of the kubelet args as a last resort. Preferably, the user should use
# the .NodeRegistration.KubeletExtraArgs object in the configuration files instead. KUBELET_EXTRA_ARGS should be sourced from this file.
EnvironmentFile=-/etc/default/kubelet
ExecStart=
ExecStart=/usr/bin/kubelet $KUBELET_KUBECONFIG_ARGS $KUBELET_CONFIG_ARGS $KUBELET_KUBEADM_ARGS $KUBELET_EXTRA_ARGS
</code></pre></li>
</ol>
