<p>I have an Azure Kubernetes Cluster with 4 nodes (Linux boxes). I provisioned the AKS cluster using yaml manifests. I want to update the following kernel parameters: net.ipv4.tcp_fin_timeout=30, net.ipv4.ip_local_port_range=1024 65500. The yaml manifest is below. How to update the yaml to include the kernel parameters that I have to change?</p>

<pre><code>apiVersion: apps/v1beta2
kind: Deployment
metadata:
  name: jmeter-slaves
  labels:
    jmeter_mode: slave
spec:
  replicas: 1
  selector:
    matchLabels:
      jmeter_mode: slave
  template:
    metadata:
      labels:
        jmeter_mode: slave
    spec:
      securityContext:
        sysctls:
        - name: net.ipv4.ip_local_port_range
          value: "1024 65500"
      containers:
      - name: jmslave
        image: prabhaharanv/jmeter-slave:latest
        command: ["/jmeter/apache-jmeter-$(JMETERVERSION)/bin/jmeter-server"]
        args: ["-Dserver.rmi.ssl.keystore.file /jmeter/apache-jmeter-$(JMETERVERSION)/bin/rmi_keystore.jks","-Djava.rmi.server.hostname=$(MY_POD_IP)", "-Dserver.rmi.localport=50000", "-Dserver_port=1099"]
        resources:
          limits:
            cpu: "1"
          requests:
            cpu: "0.5"
        imagePullPolicy: Always
        ports:
        - containerPort: 1099
        - containerPort: 50000
        env:
          - name: MY_POD_IP
            valueFrom:
              fieldRef:
                fieldPath: status.podIP
          - name: JMETERVERSION
            value: "5.1.1"

---

apiVersion: v1
kind: Service
metadata:
  name: jmeter-slaves-svc
  labels:
    jmeter_mode: slave
spec:
  clusterIP: None
  ports:
    - port: 1099
      name: first
      targetPort: 1099
    - port: 50000
      name: second
      targetPort: 50000
  selector:
    jmeter_mode: slave

---
</code></pre>

prabhaharan
<p>Take a look at <a href="https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/" rel="nofollow noreferrer">this</a> official kubernetes documentation section. There is all the information you need to set the mentioned <strong>kernel parameters</strong> or using different terminology - <strong>sysctls</strong>, in your <code>Pod</code>.</p>

<p>Note that there are so called <strong>safe</strong> and <strong>unsafe</strong> sysctls.</p>

<p>As to setting <code>net.ipv4.ip_local_port_range=1024 65500</code>, it is considered as <em>safe one</em> and you can set it for your <code>Pod</code> using a <code>securityContext</code> like below without a need to reconfigure the <strong>kubelet</strong> on your node:</p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: sysctl-example
spec:
  securityContext:
    sysctls:
    - name: net.ipv4.ip_local_port_range
      value: "1024 65500"
    - name: net.ipv4.tcp_fin_timeout
      value: "30"
  ...
</code></pre>

<p>However if you try to set this way also <code>net.ipv4.tcp_fin_timeout</code> you'll see plenty of failed attempts to create a <code>Pod</code> with the status <code>SysctlForbidden</code>:</p>

<pre><code>kubectl get pods
...
nginx-deployment-668d699fd8-zlvdm   0/1     SysctlForbidden   0          31s
nginx-deployment-668d699fd8-ztzpr   0/1     SysctlForbidden   0          58s
nginx-deployment-668d699fd8-zx4vq   0/1     SysctlForbidden   0          24s
...
</code></pre>

<p>It happens because <code>net.ipv4.tcp_fin_timeout</code> is an <em>unsafe sysctl</em> which needs to be explicitely allowed on node level by reconfiguring your <strong>kubelet</strong>.</p>

<p>To allow it you need to edit your <strong>kubelet</strong> configuration, specifically add one more option to those with which it is already started. You will typically find those options in file <code>/etc/default/kubelet</code>. You simply need to add one more:</p>

<pre><code>--allowed-unsafe-sysctls 'net.ipv4.tcp_fin_timeout'
</code></pre>

<p>and restart your <strong>kubelet</strong>:</p>

<pre><code>systemctl restart kubelet.service
</code></pre>

<p>Once <code>net.ipv4.tcp_fin_timeout</code> is allowed on node level, you can set it the same way as any <em>safe sysctls</em> i.e. via <code>securityContext</code> in your <code>Pod</code> specification.</p>
