<p>We need to enable some sysctl parameters in kubernetes. This should be achievable with the below annotation in the Deployment. </p>

<pre><code>annotations:
  security.alpha.kubernetes.io/unsafe-sysctls: net.ipv4.ip_local_port_range="10240 65535"
</code></pre>

<p>When doing so the container fails to start with the error:</p>

<pre><code>Warning  FailedCreatePodSandBox  8s (x12 over 19s)  kubelet, &lt;node&gt;  Failed create pod sandbox.
</code></pre>

<p>The solution looks to be to add this flag to the kublet:</p>

<pre><code>--experimental-allowed-unsafe-sysctls
</code></pre>

<p>Which for other flags can be done under <em>kubelet</em> in</p>

<pre><code>kops edit cluster
</code></pre>

<p>Does anyone know the correct way to do this as it refuses to pick up the setting when entering the flag there.</p>

<p>Thanks,
Alex</p>

the_frank
<p>A fix for this was merged back in May, you can see the PR here: <a href="https://github.com/kubernetes/kops/pull/5104/files" rel="nofollow noreferrer">https://github.com/kubernetes/kops/pull/5104/files</a></p>

<p>You'd enable it with:</p>

<pre><code>spec:
  kubelet:
    ExperimentalAllowedUnsafeSysctls:
      - 'net.ipv4.ip_local_port_range="10240 65535"'
</code></pre>

<p>It seems the flag takes a stringSlice, so you'd need to pass an array.</p>

<p>If that doesn't work, ensure you're using the right version of kops</p>
