<p>New to kubernetes and trying to get an elasticsearch container running. I've got logstash and kibana running fine within the pod, but elasticsearch keeps crashing with a vm.max_map_count issue.</p>
<pre><code>{&quot;@timestamp&quot;:&quot;2023-10-06T01:10:53.624Z&quot;, &quot;log.level&quot;:&quot;ERROR&quot;, &quot;message&quot;:&quot;node validation exception\n[1] bootstrap checks failed. You must address the points described in the following [1] lines before starting Elasticsearch.\nbootstrap check failure [1] of [1]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]&quot;, &quot;ecs.version&quot;: &quot;1.2.0&quot;,&quot;service.name&quot;:&quot;ES_ECS&quot;,&quot;event.dataset&quot;:&quot;elasticsearch.server&quot;,&quot;process.thread.name&quot;:&quot;main&quot;,&quot;log.logger&quot;:&quot;org.elasticsearch.bootstrap.Elasticsearch&quot;,&quot;elasticsearch.node.name&quot;:&quot;elk-stack-545f7d5996-bkbtc&quot;,&quot;elasticsearch.cluster.name&quot;:&quot;docker-cluster&quot;}
</code></pre>
<p>From other posts, this should be a pretty straight forward fix using an init container. I've set one up that runs fine, but I'm still running into the error. I've tried elevating the elasticsearch container and running the command in it instead of the init container, but when I do that I get a read-only issue. I feel like I must be misunderstanding something and missing what should be an obvious solution.</p>
<p>Init container yaml</p>
<pre><code>      initContainers:
      - name: max-map-count-setter-elasticsearch
        image: busybox:1.28
        command: ['sysctl', '-w', 'vm.max_map_count=262144']
        securityContext: 
          privileged: true
</code></pre>
<p>elasticsearch container yaml</p>
<pre><code>      - name: elasticsearch
        image: docker.elastic.co/elasticsearch/elasticsearch:8.10.2
        resources:
          requests:
            memory: 2Gi
          limits:
            memory: 2Gi
        ports:
        - containerPort: 9200
        - containerPort: 9300
        securityContext: 
          allowPrivilegeEscalation: true
          capabilities:
            drop: [&quot;ALL&quot;]
          runAsNonRoot: true
          seccompProfile:
            type: RuntimeDefault
</code></pre>
<p>Value of vm.max_map_count when using kubectl exec to access the container's terminal</p>
<pre><code>elasticsearch@elk-stack-545f7d5996-jsqsn:~$ sysctl vm.max_map_count
vm.max_map_count = 65530
</code></pre>
<p>Running the command directly on the container also gives a read-only error.</p>
<p>The cluster itself is 3 nodes (1 control-plane, 2 workers) running off of talos. It's all virtualized on Proxmox as well, if that makes any difference.</p>
<p>Any help would be appreciated!</p>

Bajiri
<p>Figured it out after a little more searching. The config had to be edited via a machineconfig patch on the Talos hosts the worker nodes were running on.</p>
<p>Edit to Talos machineconfig yaml</p>
<pre><code>sysctls:
  vm.max_map_count: 262144
</code></pre>
<p>Applied with <code>talosctl -n &lt;IP&gt; apply-config -f &lt;yaml&gt; --talosconfg=&lt;config&gt;</code>.</p>
<p>The deployment seems to be working fine after that.</p>
