Change:
Forked from To make debian-based node compatible with docker 1.11.X, I updated both /proc/sys/kernel/keys/rootmaxkey and /proc/sys/kernel/keys/rootmaxbytes. Also other kubernetes components do the similar thing. For example, kube_proxy: We should clean up those configurations into one common place.
cc/
Is this looking for an owner? It seems the ask is to generalize these types of settings in a module.
Yeah. We update quite a few kernel settings in kubelet itself. We should move the ones mentioned in this issue to kubelet if it is applicable to other distros too. want to own this?
Sure, I'll start poking.
Test results so far for a few distributions' default settings Operating SystemValue --- --- Debian Jessie 8.7.5200 --- --- --- Ubuntu 14. --- --- --- Ubuntu 16. --- --- --- CentOS --- --- --- Fedora --- --- --- Redhat Atomic --- --- --- CoreOS stable1000000 --- --- undefined --- undefined

Discussion:
"crypto/tls" "errors" "fmt" <del> "io/ioutil" </del> "math/rand" "net" "net/http"

"os" "path" "strconv" <del> "strings" </del> "time" "github.com/golang/glog"

rlimit.RlimitNumFiles(uint64(kubeCfg.MaxOpenFiles)) <del> // TODO(dawnchen): remove this once we deprecated old debian containervm images. // This is a workaround for issue: https://github.com/opencontainers/runc/issues/726 // The current chosen number is consistent with most of other os dist. const maxKeysPath = "/proc/sys/kernel/keys/root_maxkeys" const minKeys uint64 = 1000000 key, err := ioutil.ReadFile(maxKeysPath) if err != nil { glog.Errorf("Cannot read keys quota in %s", maxKeysPath) } else { fields := strings.Fields(string(key)) nKey, _ := strconv.ParseUint(fields[0], 10, 64) if nKey < minKeys { glog.Infof("Setting keys quota in %s to %d", maxKeysPath, minKeys) err = ioutil.WriteFile(maxKeysPath, []byte(fmt.Sprintf("%d", uint64(minKeys))), 0644) if err != nil { glog.Warningf("Failed to update %s: %v", maxKeysPath, err) } } } const maxBytesPath = "/proc/sys/kernel/keys/root_maxbytes" const minBytes uint64 = 25000000 bytes, err := ioutil.ReadFile(maxBytesPath) if err != nil { glog.Errorf("Cannot read keys bytes in %s", maxBytesPath) } else { fields := strings.Fields(string(bytes)) nByte, _ := strconv.ParseUint(fields[0], 10, 64) if nByte < minBytes { glog.Infof("Setting keys bytes in %s to %d", maxBytesPath, minBytes) err = ioutil.WriteFile(maxBytesPath, []byte(fmt.Sprintf("%d", uint64(minBytes))), 0644) if err != nil { glog.Warningf("Failed to update %s: %v", maxBytesPath, err) } } } </del> // process pods and exit. if runOnce { if _, err := k.RunOnce(podCfg.Updates()); err != nil {

utilsysctl.VmPanicOnOOM:       utilsysctl.VmPanicOnOOMInvokeOOMKiller, utilsysctl.KernelPanic:        utilsysctl.KernelPanicRebootTimeout, utilsysctl.KernelPanicOnOops:  utilsysctl.KernelPanicOnOopsAlways, <ins> utilsysctl.RootMaxKeys:        utilsysctl.RootMaxKeysSetting, utilsysctl.RootMaxBytes:       utilsysctl.RootMaxBytesSetting, </ins> } sysctl := utilsysctl.New()

VmPanicOnOOM       = "vm/panic_on_oom" KernelPanic        = "kernel/panic" KernelPanicOnOops  = "kernel/panic_on_oops" <ins> RootMaxKeys        = "kernel/keys/root_maxkeys" RootMaxBytes       = "kernel/keys/root_maxbytes" </ins> VmOvercommitMemoryAlways    = 1 // kernel performs no memory over-commit handling VmPanicOnOOMInvokeOOMKiller = 0 // kernel calls the oom_killer function when OOM occurs KernelPanicOnOopsAlways  = 1  // kernel panics on kernel oops KernelPanicRebootTimeout = 10 // seconds after a panic for the kernel to reboot <ins> RootMaxKeysSetting  = 1000000                 // Needed since docker creates a new key per container RootMaxBytesSetting = RootMaxKeysSetting * 25 // allocate 25 bytes per key * number of MaxKeys </ins> ) // An injectable interface for running sysctl commands.