Code change:
"net.ipv4.ip_unprivileged_port_start", } <ins> var safeSysctlsIncludeReservedPorts = []string{ "kernel.shm_rmid_forced", "net.ipv4.ip_local_port_range", "net.ipv4.tcp_syncookies", "net.ipv4.ping_group_range", "net.ipv4.ip_unprivileged_port_start", "net.ipv4.ip_local_reserved_ports", } </ins> // SafeSysctlAllowlist returns the allowlist of safe sysctls and safe sysctl patterns (ending in *). // // A sysctl is called safe iff // - it is namespaced in the container or the pod // - it is isolated, i.e. has no influence on any other pod on the same node. func SafeSysctlAllowlist() []string { <ins> if goruntime.GOOS == "linux" { // make sure we're on a new enough kernel that the ip_local_reserved_ports sysctl is namespaced kernelVersion, err := getKernelVersion() if err != nil { klog.ErrorS(err, "Failed to get kernel version, dropping net.ipv4.ip_local_reserved_ports from safe sysctl list") return safeSysctls } if kernelVersion.LessThan(version.MustParseGeneric(ipLocalReservedPortsMinNamespacedKernelVersion)) { klog.ErrorS(nil, "Kernel version is too old, dropping net.ipv4.ip_local_reserved_ports from safe sysctl list", "kernelVersion", kernelVersion) return safeSysctls } } return safeSysctlsIncludeReservedPorts } func getKernelVersion() (*version.Version, error) { </ins> kernelVersionStr, err := ipvs.NewLinuxKernelHandler().GetKernelVersion() if err != nil { <del> klog.ErrorS(err, "Failed to get kernel version.") return safeSysctls </del> <ins> return nil, fmt.Errorf("failed to get kernel version: %w", err) </ins> } kernelVersion, err := version.ParseGeneric(kernelVersionStr) if err != nil { <del> klog.ErrorS(err, "Failed to parse kernel version.") return safeSysctls } // ip_local_reserved_ports has been changed to namesapced since kernel v3.16. // refer to https://github.com/torvalds/linux/commit/122ff243f5f104194750ecbc76d5946dd1eec934. if kernelVersion.LessThan(version.MustParseGeneric(ipLocalReservedPortsMinNamespacedKernelVersion)) { return safeSysctls } return []string{ "kernel.shm_rmid_forced", "net.ipv4.ip_local_port_range", "net.ipv4.tcp_syncookies", "net.ipv4.ping_group_range", "net.ipv4.ip_unprivileged_port_start", "net.ipv4.ip_local_reserved_ports", </del> <ins> return nil, fmt.Errorf("failed to parse kernel version: %w", err) </ins> } <ins> return kernelVersion, nil </ins> }

Related discussion:
text: E0320 18:35:17. 4656 ] "Failed to get kernel version." err="error reading osrelease file "/proc/sys/kernel/osrelease": open /proc/sys/kernel/osrelease: The system cannot find the path specified." handle windows node correctly. Run kubelet v1.27 beta+ on windows. This is an example v1.27.0-beta* N/A windows <details</details<details</details<details</details
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/sig node windows The issue came from
/assign
This Issue/PR has been marked as release blocker. Please have the fix merged by eod today otherwise the feature has to be reverted. For the Issue/PR owner: please have a revert/feature disable PR open today in case the fix failed to get in. Thank you! See the -- Kubernetes 1.27 release manager