OCPBUGS-61679: pkg:add missing safe sysctls to list of SafeSysctlAllowlist #149
Conversation
openshift-ci
bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
Signed-off-by: jubittajohn <[email protected]>
jubittajohn
force-pushed
the
4.20-update-safed-sysctl
branch
from
0357dbe to
5f1f9f1
Compare
jubittajohn
changed the title
openshift-ci-robot
added
jira/severity-important
|
@jubittajohn: This pull request references Jira Issue OCPBUGS-61679, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira refresh |
openshift-ci-robot
added
the
jira/valid-bug
|
@jubittajohn: This pull request references Jira Issue OCPBUGS-61679, which is valid. The bug has been moved to the POST state. 7 validation(s) were run on this bug
Requesting review from QA contact: In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
removed
the
jira/invalid-bug
openshift-ci
bot
removed
the
do-not-merge/work-in-progress
|
@jubittajohn: all tests passed! Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
@jubittajohn: This pull request references Jira Issue OCPBUGS-61679, which is valid. 7 validation(s) were run on this bug
Requesting review from QA contact: In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/lgtm |
|
@bertinatto: Can not set label backport-risk-assessed: Must be member in one of these teams: [openshift-patch-managers openshift-release-oversight openshift-staff-engineers openshift-sustaining-engineers] In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: bertinatto, jubittajohn The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
|
/verified later @xingxingxia |
openshift-ci-robot
added
verified-later
verified
|
@xingxingxia: This PR has been marked to be verified later by In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
| func getSafeSysctlAllowlist(getVersion func() (*version.Version, error)) []string { | ||
| safeSysctlAllowlist := slices.Clone(legacySafeSysctls) | ||
|
|
||
| kernelVersion, err := getVersion() |
There was a problem hiding this comment.
Pod SCC admission will be executing on a control plane node in a kube-apiserver process, and this is reading the local kernel version. Don't we want admission to consider the kernel version on the Node that the Pod is assigned to?
/hold
There was a problem hiding this comment.
@benluddy / @jubittajohn anything I can help you two out to push https://issues.redhat.com/browse/OCPBUGS-61679 further?
as for this comment specifically, I think there is no way besides a webhook or node object inspection to figure this out. Do we really need this validation?
There was a problem hiding this comment.
@tjungblu
Linking the discussion thread here: https://redhat-internal.slack.com/archives/CC3CZCQHM/p1758217953650509.
The main output of the discussion was to admit a sysctl if atleast one worker node supports it, and to add e2e test to capture the behavior.
#151 - Linking the draft PR I have with a slightly different approach which gets the minimum kernel version across currently available worker nodes. Not yet tested against a cluster or covered by unit tests.
openshift-ci
bot
added
the
do-not-merge/hold
6 participants
As part of Kubernetes v1.32, several sysctls [1] have been added to the SafeSysctlAllowlist. However, that list has not yet been updated in OCP. This change addresses that issue.
[1] https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#safe-and-unsafe-sysctls
This is a manual cherry-pick of #148