Error setting sysctl parameters "net.ipv4.tcp_retries2" for a specific pod in the AKS cluster

Question

I am working on a requirement wherein we want to update a specific kernel parameter "net.ipv4.tcp_retries2" to "5" in the Kubernetes POD.

We are using AKS cluster v1.21.7

I tried using securityContext to set the above sysctl parameters but it failed

  template:
    metadata:
      labels:
        app.kubernetes.io/name: weather-forecast-api
        app.kubernetes.io/instance: RELEASE-NAME
    spec:
      serviceAccountName: RELEASE-NAME-weather-forecast-api
      securityContext:
        sysctls:
        - name: net.ipv4.tcp_retries2
          value: "5"

When I applied the above changes in the AKS, the pod failed to run and gave the error

forbidden sysctl: "net.ipv4.tcp_retries2" not whitelisted

I know we can modify kernel-level settings at the Kubelet level on a bare-bone Kubernetes cluster but in my case, it is a managed cluster from Azure.

Answer 1

Use an init container to set:

...
template:
  metadata:
    labels:
      app.kubernetes.io/name: weather-forecast-api
      app.kubernetes.io/instance: RELEASE-NAME
  spec:
    serviceAccountName: RELEASE-NAME-weather-forecast-api
    initContainers:
    - name: sysctl
      image: busybox
      securityContext:
        privileged: true
      command: ["sh", "-c", "sysctl -w net.ipv4.tcp_retries2=3"]
    ...

Answer 2

Below steps resolved my issue: (This for setting netIpv4TcpFinTimeOut value at the pod level)

1. Created a config like below (name as linuxconfig.json)

{
  "allowedUnsafeSysctls":[
    "net.*"
  ],
  "sysctls": [
    "netIpv4TcpFinTimeOut": 20,
  ]
}

2. Added a nodepool with --kubelet-config

az aks nodepool add --name nodepoolname --cluster-name clustername --resource-group resourcegroupname –kubelet-config ./linuxconfig.json

3. Created the pod using below YAML:

apiVersion: v1
kind: Pod
metadata:
  name: test
spec:
  securityContext:
    sysctls:
      - name: net.ipv4.tcp_fin_timeout
        value: "30"
  containers:
    - name: nginx
      image: nginx