<p>I'm trying to execute on the node <code>kubelet --allowed-unsafe-sysctls   'net.core.somaxconn'</code></p>
<p>but return <code>Flag --allowed-unsafe-sysctls has been deprecated, This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.</code></p>
<p>I also tried using PodSecurityPolicy, but it still doesn't work</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: PodSecurityPolicy
metadata:
  name: sysctl-psp
spec:
  sysctls:
    - net.*
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  runAsUser:
    rule: RunAsAny
  fsGroup:
    rule: RunAsAny
</code></pre>
<p>I received the following error:
<code>forbidden sysctl: &quot;net.core.somaxconn&quot; not whitelisted</code></p>
<p>yaml  detailed:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Pod
metadata:
  name: sysctl-example
spec:
  securityContext:
    sysctls:
      - name: net.core.somaxconn
        value: &quot;65535&quot;
        unsafe: true
  containers:
    - image: tomcat
      name: tomcat
</code></pre>

<p>As the error suggests, You need to start the Kubelet with the <code>--config</code> flag which sets the path of the Kubelet's config file. The Kubelet will then load its config from this file.</p>
<p>You can write the config file by yourself or generate it by <a href="https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/#create-the-config-file" rel="noreferrer">KubeletConfiguration</a> object.</p>
<p>Sample YAML:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
allowedUnsafeSysctls:
- &quot;net.core.somaxconn&quot;
</code></pre>
<p>Follow this doc - <a href="https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/" rel="noreferrer">Set Kubelet parameters via a config file</a></p>
