Repository: kubernetes
Issue: Minimal kernel version plan: probably 4.18/4.19+
Labels: sig/node,kind/feature,priority/important-longterm,triage/accepted

### Summary
**checked means `EOL`**
- [x] 3.10, Current System Validator check
- [x] 3.16, Namespaced IP Local Reserved Ports (safe-sysctl)
- [x] 3.18, containerd suggestion when using btrfs.(containerd, btrfs)
- [x] 4.x, containerd suggested min kernel version (containerd,  core code and snapshotters)
- [x] 4.1, reuse min supported kernel version (kube-proxy)
- [ ] 4.4 **CIP** https://en.wikipedia.org/wiki/Linux_kernel_version_history: 4.4 is quite special: As the first kernel selected for Super Long Term Support (SLTS), the Civil Infrastructure Platform will provide support until at least 2026. For CIP details, check https://gitlab.com/cip-project/cip-kernel/linux-cip/-/tags and https://wiki.linuxfoundation.org/civilinfrastructureplatform/start. 
- [x] 4.5, namespaced net.ipv4.tcp_keepalive_time (safe-sysctl)
- [x] ~~4.9 LTS, EOL in Jan 2023.~~ (linux, LTS)
- [x] ~~4.11 EOL~
  - calico flex can reduce CPU usage by setting iptablesRefreshInterval (calico,cpu)
  - net.ipv4.ip_unprivileged_port_start (safe-sysctl) https://github.com/kubernetes/kubernetes/pull/105309 
- [x] ~~4.14 LTS **EOL in Jan 2024**~~ (linux, LTS) 
- [x]  **CentOS Linux 7** end of life is June 30, 2024
- [x] ~~4.19  🌟🌟🌟 **LTS**  EOL Dec 2024. (linux, LTS); **CIP**~~
  - [x] cilium bump in v1.4 for eBPF supports(cilium,ebpf)
  - [x] RSS problem with docker(fixed in 4.19.77 or 5.2.19+, 5.3.4+) (docker)
  - [x] The overlayfs snapshotter does not work inside user namespaces before kernel 5.11, except on Ubuntu and Debian kernels. However, [fuse-overlayfs snapshotter](https://github.com/containerd/fuse-overlayfs-snapshotter) can be used instead if running kernel >= 4.18.  https://github.com/containerd/containerd/blob/ac0f34f0ec03c818797f085ee2fe39329689d77c/docs/rootless.md
- [x] EOL 5.2 https://github.com/opencontainers/runc/blob/v1.1.13/docs/cgroup-v2.md : Kernel older than 5.2 is not recommended due to lack of freezer.
- [ ] 5.4 **LTS** EOL Dec 2025 (nftables testing)
- [x] 5.8, Cgroup V2 suggestions (cgroup v2) 🌟🌟
  - [x] (v1.31 which will be release in 2024 Q3)Move cgroup v1 support into maintenance mode kubernetes/enhancements#4572 
- [ ] 5.10 **LTS** EOL Dec 2026 **CIP**
- [X] 5.12(EOL)
  - Recursively Read-only (RRO) hostPath mounts (RRO)
  - Support idmapped mounts (UserNamespace)
- [x] 5.14 nftables: kube-proxy now requires version 1.0.1 or later of the nft 
- [ ] 5.15 **LTS** EOL Oct 2026
- [ ] 6.1 **LTS** EOL Dec 2026 **CIP**
- [x] 6.3(EOL) tmpfs noswap KEP-2400
- [x] 6.4(EOL) Pod User Namespace KEP-127
- [ ] 6.6 **LTS**

Some info from https://github.com/kubernetes/kubernetes/blob/master/pkg/util/kernel/constants.go
- const UserNamespacesSupportKernelVersion = "6.3"
- const TmpfsNoswapSupportKernelVersion = "6.4"


### What would you like to be added?

Currently, there is a kernel version check-in system validator that is used by kubeadm. (**// Requires 3.10+, or newer**)
- This issue aims to track which version should minimum kernel version be raised to. The current status and the plan.

https://github.com/kubernetes/kubernetes/blob/c9ff2866682432075da1a961bc5c3f681b34c8ea/vendor/k8s.io/system-validators/validators/types_unix.go#L31

During the weekly sig-node meeting, there was a discussion about adding a kernel-version-sensitive safe sysctl in kubelet. It was noted that 3.16 is considered to be a very low kernel version and it was suggested that we introduce a minimal kernel version for Kubernetes. Alternatively, we should have a warning for low kernel versions(I think that we should add a warning if the kernel version is less than 3.18 or 4.0).
 - Cgroups v2 GA opens up the possibility for new features but sets the minimal bar for dependencies again.
   - Cgroup v2 suggests `Linux Kernel version is 5.8 or later`. https://kubernetes.io/docs/concepts/architecture/cgroups/

https://github.com/kubernetes/kubernetes/blob/c9ff2866682432075da1a961bc5c3f681b34c8ea/pkg/kubelet/sysctl/safe_sysctls.go#L25

### Why is this needed?

Some historical issues related and some CNCF projects like cilium: https://github.com/kubernetes/kubernetes/issues/30706
- https://github.com/cilium/cilium/issues/22116
- https://github.com/kubernetes/kubernetes/pull/89327

https://github.com/kubernetes/kubernetes/blob/c9ff2866682432075da1a961bc5c3f681b34c8ea/pkg/proxy/ipvs/proxier.go#L93

https://github.com/kubernetes/kubernetes/blob/c9ff2866682432075da1a961bc5c3f681b34c8ea/cluster/addons/calico-policy-controller/felixconfigurations-crd.yaml#L320-L324

https://github.com/containerd/containerd#runtime-requirements
> There are specific features used by containerd core code and snapshotters that will require a minimum kernel version on Linux. With the understood caveat of distro kernel versioning, a reasonable starting point for Linux is a minimum 4.x kernel version.