<p>I'm running a k8s cluster - 1.9.4-gke.1 - on Google Kubernetes Engine (GKE).</p>

<p>I need to set sysctl <code>net.core.somaxconn</code> to a higher value inside some containers.</p>

<p>I've found this official k8s page: <a href="https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster" rel="nofollow noreferrer">Using Sysctls in a Kubernetes Cluster</a> - that seemed to solve my problem. The solution was to make an annotation on my pod spec like the following:</p>

<pre><code>annotations:
  security.alpha.kubernetes.io/sysctls: net.core.somaxconn=1024
</code></pre>

<p>But when I tried to create my pod:</p>

<pre><code>Status:         Failed
Reason:         SysctlForbidden
Message:        Pod forbidden sysctl: "net.core.somaxconn" not whitelisted
</code></pre>

<p>So I've tried to create a PodSecurityPolicy like the following:</p>

<pre><code>---
apiVersion: extensions/v1beta1
kind: PodSecurityPolicy
metadata:
  name: sites-psp
  annotations:
    security.alpha.kubernetes.io/sysctls: 'net.core.somaxconn'
spec:
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  runAsUser:
    rule: RunAsAny
  fsGroup:
    rule: RunAsAny
  volumes:
  - '*'
</code></pre>

<p>... but it didn't work either.</p>

<p>I've also found that I can use a <code>kubelet</code> argument on every node to whitelist the specific <code>sysctl</code>: <code>--experimental-allowed-unsafe-sysctls=net.core.somaxconn</code></p>

<p>I've added this argument to the KUBELET_TEST_ARGS setting on my GCE machine and restarted it. From what I can see from the output of <code>ps</code> command, it seems that the option was successfully added to the <code>kubelet</code> process on the startup:</p>

<pre><code>/home/kubernetes/bin/kubelet --v=2 --kube-reserved=cpu=60m,memory=960Mi --experimental-allowed-unsafe-sysctls=net.core.somaxconn --allow-privileged=true --cgroup-root=/ --cloud-provider=gce --cluster-dns=10.51.240.10 --cluster-domain=cluster.local --pod-manifest-path=/etc/kubernetes/manifests --experimental-mounter-path=/home/kubernetes/containerized_mounter/mounter --experimental-check-node-capabilities-before-mount=true --cert-dir=/var/lib/kubelet/pki/ --enable-debugging-handlers=true --bootstrap-kubeconfig=/var/lib/kubelet/bootstrap-kubeconfig --kubeconfig=/var/lib/kubelet/kubeconfig --anonymous-auth=false --authorization-mode=Webhook --client-ca-file=/etc/srv/kubernetes/pki/ca-certificates.crt --cni-bin-dir=/home/kubernetes/bin --network-plugin=kubenet --volume-plugin-dir=/home/kubernetes/flexvolume --node-labels=beta.kubernetes.io/fluentd-ds-ready=true,cloud.google.com/gke-nodepool=temp-pool --eviction-hard=memory.available&lt;100Mi,nodefs.available&lt;10%,nodefs.inodesFree&lt;5% --feature-gates=ExperimentalCriticalPodAnnotation=true
</code></pre>

<p>The problem is that I keep receiving a message telling me that my pod cannot be started because sysctl <code>net.core.somaxconn</code> is not whitelisted.</p>

<p>Is there some limitation on GKE so that I cannot whitelist a sysctl? Am I doing  something wrong?</p>

<p>Until sysctl support becomes better integrated you can put this in your pod spec</p>

<pre><code>spec:
  initContainers:
    - name: sysctl-buddy
      image: busybox:1.29
      securityContext:
        privileged: true
      command: ["/bin/sh"]
      args:
        - -c
        - sysctl -w net.core.somaxconn=4096 vm.overcommit_memory=1
      resources:
        requests:
          cpu: 1m
          memory: 1Mi
</code></pre>
