Skip to content

Commit 94bb80c

Browse files
pattyhairpattyhair
authored
Merge pull request #46 from sachingade20/nodel-level-examples
Added node level sysctl chart for elasticsearch tuning
2 parents 7594954 + 0c6e4b1 commit 94bb80c

File tree

11 files changed

+163
-0
lines changed

11 files changed

+163
-0
lines changed

‎cloudbees-cd/node-level-sysctl/Chart.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
apiVersion: v2
2+
name: node-level-sysctl
3+
description: TODO
4+
version: 0.1.0
5+
appVersion: N/A

‎cloudbees-cd/node-level-sysctl/LICENSE‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2021 Cloudbees Flow Public Repos
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎cloudbees-cd/node-level-sysctl/README.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
Allows you to configure [node-level sysctls](https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#setting-sysctls-for-a-pod).
2+
Useful for setting Linux kernel parameters which are not namespaced and so not supported by Kubernetes.
3+
4+
A simpler version of [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator).
5+
6+
7+
8+
Example Install Command for increasing kernet sysctl count:
9+
10+
```
11+
12+
helm install \
13+
--wait \
14+
--namespace kube-system \
15+
--set "parameters.vm\.max_map_count=262144" \
16+
--set podSecurityPolicy.enabled=true \
17+
tune-max-map-count ./
18+
19+
```

‎cloudbees-cd/node-level-sysctl/templates/NOTES.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Kernel parameters should now be tuned.

‎cloudbees-cd/node-level-sysctl/templates/_helpers.tpl‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
{{/*
2+
TODO add any required helper functions here
3+
*/}}

‎cloudbees-cd/node-level-sysctl/templates/daemonset.yaml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
apiVersion: apps/v1
2+
kind: DaemonSet
3+
metadata:
4+
name: {{ .Release.Name }}
5+
spec:
6+
selector:
7+
matchLabels:
8+
name: {{ .Release.Name }}
9+
template:
10+
metadata:
11+
labels:
12+
name: {{ .Release.Name }}
13+
spec:
14+
nodeSelector:
15+
kubernetes.io/os: linux
16+
{{- if .Values.podSecurityPolicy.enabled }}
17+
serviceAccount: {{ .Release.Name }}
18+
{{- end }}
19+
terminationGracePeriodSeconds: 3
20+
containers:
21+
- name: tune
22+
image: busybox:stable
23+
securityContext:
24+
privileged: true
25+
runAsUser: 0
26+
resources:
27+
requests:
28+
cpu: 1m
29+
memory: 1Mi
30+
command:
31+
- sh
32+
- -c
33+
- |
34+
set -ex
35+
{{- range $k, $v := .Values.parameters }}
36+
sysctl -w {{ $k }}={{ $v }}
37+
{{- end }}
38+
sleep infinity

‎cloudbees-cd/node-level-sysctl/templates/psp.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{{- if .Values.podSecurityPolicy.enabled }}
2+
apiVersion: policy/v1beta1
3+
kind: PodSecurityPolicy
4+
metadata:
5+
name: privileged-{{ .Release.Namespace }}-{{ .Release.Name }}
6+
annotations:
7+
seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
8+
spec:
9+
privileged: true
10+
allowPrivilegeEscalation: true
11+
allowedCapabilities:
12+
- '*'
13+
volumes:
14+
- '*'
15+
hostNetwork: true
16+
hostPorts:
17+
- min: 0
18+
max: 65535
19+
hostIPC: true
20+
hostPID: true
21+
runAsUser:
22+
rule: 'RunAsAny'
23+
seLinux:
24+
rule: 'RunAsAny'
25+
supplementalGroups:
26+
rule: 'RunAsAny'
27+
fsGroup:
28+
rule: 'RunAsAny'
29+
{{- end }}

‎cloudbees-cd/node-level-sysctl/templates/role.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{{- if .Values.podSecurityPolicy.enabled }}
2+
kind: Role
3+
apiVersion: rbac.authorization.k8s.io/v1
4+
metadata:
5+
name: {{ .Release.Name }}
6+
rules:
7+
- apiGroups:
8+
- extensions
9+
resources:
10+
- podsecuritypolicies
11+
verbs:
12+
- use
13+
resourceNames:
14+
- privileged-{{ .Release.Namespace }}-{{ .Release.Name }}
15+
{{- end -}}

‎cloudbees-cd/node-level-sysctl/templates/rolebinding.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{{- if .Values.podSecurityPolicy.enabled }}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: RoleBinding
4+
metadata:
5+
name: {{ .Release.Name }}
6+
roleRef:
7+
apiGroup: rbac.authorization.k8s.io
8+
kind: Role
9+
name: {{ .Release.Name }}
10+
subjects:
11+
- kind: ServiceAccount
12+
name: {{ .Release.Name }}
13+
{{- end -}}

‎cloudbees-cd/node-level-sysctl/templates/sa.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{{- if .Values.podSecurityPolicy.enabled }}
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: {{ .Release.Name }}
6+
{{- end -}}

0 commit comments

Comments
 (0)