|
| 1 | +--- |
| 2 | +content_type: "reference" |
| 3 | +title: Linux Kernel Version Requirements |
| 4 | +weight: 10 |
| 5 | +--- |
| 6 | + |
| 7 | +{{% thirdparty-content %}} |
| 8 | + |
| 9 | +Many features rely on specific kernel functionalities and have minimum kernel version requirements. |
| 10 | +However, relying solely on kernel version numbers may not be sufficient |
| 11 | +for certain operating system distributions, |
| 12 | +as maintainers for distributions such as RHEL, Ubuntu and SUSE often backport selected features |
| 13 | +to older kernel releases (retaining the older kernel version). |
| 14 | + |
| 15 | +## Pod sysctls |
| 16 | + |
| 17 | +On Linux, the `sysctl()` system call configures kernel parameters at run time. There is a command |
| 18 | +line tool named `sysctl` that you can use to configure these parameters, and many are exposed via |
| 19 | +the `proc` filesystem. |
| 20 | + |
| 21 | +Some sysctls are only available if you have a modern enough kernel. |
| 22 | + |
| 23 | +The following sysctls have a minimal kernel version requirement, |
| 24 | +and are supported in the [safe set](/docs/tasks/administer-cluster/sysctl-cluster/#safe-and-unsafe-sysctls): |
| 25 | + |
| 26 | +<!-- |
| 27 | +Code: https://github.com/kubernetes/kubernetes/blob/00236ae0d73d2455a2470469ed1005674f8ed61f/pkg/util/kernel/constants.go#L19-L45 |
| 28 | +--> |
| 29 | +- `net.ipv4.ip_local_reserved_ports` (since Kubernetes 1.27, needs kernel 3.16+); |
| 30 | +- `net.ipv4.tcp_keepalive_time` (since Kubernetes 1.29, needs kernel 4.5+); |
| 31 | +- `net.ipv4.tcp_fin_timeout` (since Kubernetes 1.29, needs kernel 4.6+); |
| 32 | +- `net.ipv4.tcp_keepalive_intvl` (since Kubernetes 1.29, needs kernel 4.5+); |
| 33 | +- `net.ipv4.tcp_keepalive_probes` (since Kubernetes 1.29, needs kernel 4.5+); |
| 34 | +- `net.ipv4.tcp_syncookies` (namespaced since kernel 4.6+). |
| 35 | +- `net.ipv4.vs.conn_reuse_mode` (used in `ipvs` proxy mode, needs kernel 4.1+); |
| 36 | + |
| 37 | +### kube proxy `nftables` proxy mode |
| 38 | + |
| 39 | +<!-- |
| 40 | +Code: https://github.com/kubernetes/kubernetes/blob/00236ae0d73d2455a2470469ed1005674f8ed61f/pkg/util/kernel/constants.go#L53-L56 |
| 41 | +--> |
| 42 | +For Kubernetes {{< skew currentVersion >}}, the |
| 43 | +[`nftables` mode](/docs/reference/networking/virtual-ips/#proxy-mode-nftables) of kube-proxy requires |
| 44 | +version 1.0.1 or later |
| 45 | +of the nft command-line tool, as well as kernel 5.13 or later. |
| 46 | + |
| 47 | +For testing/development purposes, you can use older kernels, as far back as 5.4 if you set the |
| 48 | +`nftables.skipKernelVersionCheck` option in the kube-proxy config. |
| 49 | +But this is not recommended in production since it may cause problems with other nftables |
| 50 | +users on the system. |
| 51 | + |
| 52 | +## Version 2 control groups |
| 53 | + |
| 54 | +Kubernetes cgroup v1 support is in maintained mode starting from Kubernetes v1.31; using cgroup v2 |
| 55 | +is recommended. |
| 56 | +In [Linux 5.8](https://github.com/torvalds/linux/commit/4a7e89c5ec0238017a757131eb9ab8dc111f961c), the system-level `cpu.stat` file was added to the root cgroup for convenience. |
| 57 | + |
| 58 | +In runc document, Kernel older than 5.2 is not recommended due to lack of freezer. |
| 59 | + |
| 60 | +## Other kernel requirements {#requirements-other} |
| 61 | + |
| 62 | +Some features may depend on new kernel functionalities and have specific kernel requirements: |
| 63 | + |
| 64 | +<!-- |
| 65 | +Code(recursive read only mount): https://github.com/kubernetes/kubernetes/blob/00236ae0d73d2455a2470469ed1005674f8ed61f/staging/src/k8s.io/cri-api/pkg/apis/runtime/v1/api.proto#L1605-L1609 |
| 66 | +Code(user namespace and swap): https://github.com/kubernetes/kubernetes/blob/00236ae0d73d2455a2470469ed1005674f8ed61f/pkg/util/kernel/constants.go#L47-L51 |
| 67 | +--> |
| 68 | +1. [Recursive read only mount](/docs/concepts/storage/volumes/#recursive-read-only-mounts): |
| 69 | + This is implemented by applying the `MOUNT_ATTR_RDONLY` attribute with the `AT_RECURSIVE` flag |
| 70 | + using `mount_setattr`(2) added in Linux kernel v5.12. |
| 71 | +2. Pod user namespace support requires minimal kernel version 6.5+, according to |
| 72 | + [KEP-127](https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/127-user-namespaces/README.md). |
| 73 | +3. For [node system swap](/docs/concepts/architecture/nodes/#swap-memory), tmpfs set to `noswap` |
| 74 | + is not supported until kernel 6.3. |
| 75 | + |
| 76 | +## Linux kernel long term maintenance |
| 77 | + |
| 78 | +Active kernel releases can be found in [kernel.org](https://www.kernel.org/category/releases.html). |
| 79 | + |
| 80 | +There are usually several _long term maintenance_ kernel releases provided for the purposes of backporting |
| 81 | +bug fixes for older kernel trees. Only important bug fixes are applied to such kernels and they don't |
| 82 | +usually see very frequent releases, especially for older trees. |
| 83 | +See the Linux kernel website for the [list of releases](https://www.kernel.org/category/releases.html) |
| 84 | +in the _Longterm_ category. |
| 85 | + |
| 86 | +## {{% heading "whatsnext" %}} |
| 87 | + |
| 88 | +- See [sysctls](/docs/tasks/administer-cluster/sysctl-cluster/) for more details. |
| 89 | +- Allow running kube-proxy with in [nftables mode](/docs/reference/networking/virtual-ips/#proxy-mode-nftables). |
| 90 | +- Read more information in [cgroups v2](/docs/concepts/architecture/cgroups/). |
0 commit comments