Code change:
exit 1 fi <del> APIROOT="${KUBE_ROOT}/pkg/api" TMP_APIROOT="${KUBE_ROOT}/_tmp/api" </del> <ins> DIFFROOT="${KUBE_ROOT}/pkg" TMP_DIFFROOT="${KUBE_ROOT}/_tmp/pkg" </ins> _tmp="${KUBE_ROOT}/_tmp" mkdir -p "${_tmp}" <del> cp -a "${APIROOT}" "${TMP_APIROOT}" </del> <ins> cp -a "${DIFFROOT}" "${TMP_DIFFROOT}" </ins> "${KUBE_ROOT}/hack/update-generated-swagger-docs.sh" <del> echo "diffing ${APIROOT} against freshly generated swagger type documentation" </del> <ins> echo "diffing ${DIFFROOT} against freshly generated swagger type documentation" </ins> ret=0 <del> diff -Naupr -I 'Auto generated by' "${APIROOT}" "${TMP_APIROOT}" || ret=$? cp -a "${TMP_APIROOT}" "${KUBE_ROOT}/pkg" </del> <ins> diff -Naupr -I 'Auto generated by' "${DIFFROOT}" "${TMP_DIFFROOT}" || ret=$? cp -a "${TMP_DIFFROOT}/" "${KUBE_ROOT}/" </ins> rm -rf "${_tmp}" if [[ $ret -eq 0 ]] then <del> echo "${APIROOT} up to date." </del> <ins> echo "${DIFFROOT} up to date." </ins> else <del> echo "${APIROOT} is out of date. Please run hack/update-generated-swagger-docs.sh" </del> <ins> echo "${DIFFROOT} is out of date. Please run hack/update-generated-swagger-docs.sh" </ins> exit 1 fi

Related discussion:
text: <!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --What happened: Following the example in , I created a pod with 3 sysctls specified in the pod's security context. Setting the sysctl resulted in the pod failing to start. What you expected to happen: I expected the pod to start with no issues. If there is something missing in the docs, I appreciate updating There is also a discussion at that suggests that kernel does not namespace certain net.* sysctls. If that's the case, can we document which sysctls are supported? I assumed is a supported sysctl because it's in the official k8s docs. How to reproduce it (as minimally and precisely as possible): Following the pod creation, the pod doesn't start: Once I delete the following two lines from the pod securityContext, the pod starts fine: Anything else we need to know?: You can see that I've enabled the unsafe sysctls with kubelet: Environment: Kubernetes version (use ):Cloud provider or hardware configuration: VMware Fusion OS (e.g: ):Kernel (e.g. ):Install tools: A single-node k8s cluster created with kubeadm Network plugin and version (if this is a network-related bug): Calico Others:
/sig node
Thank you for the incredibly detailed issue report :) I did some poking around, and if is accurate and still current, then I believe the issue is that is not namespaced (i.e. cannot be set on a per pod/container level). If I'm understanding correctly, we'd need to make changes to the Linux kernel in order for it to be namespaced. As a disclaimer, I'm not positive if this parameter became namespaced in new kernels... it could be interesting to investigate if this still happens on a machine with the latest kernel. W.r.t. fixes... I would agree with you that short term, we need to update this documentation so that it doesn't include . do you have any interest in doing so? If not, I'm happy to.