Can I disable unsafe sysctl on DigitalOcean Kubernetes?

In Linux, the sysctl interface allows an administrator to modify kernel parameters at runtime. Parameters are available via the /proc/sys/ virtual process file system. These parameters cover various subsystems, such as:

• Kernel (common prefix: kernel.)
• Networking (common prefix: net.)
• Virtual memory (common prefix: vm.)
• MDADM (common prefix: dev.)

On DigitalOcean, you cannot access the nodes to make configuration changes to the underlying virtual machine. This allows us to maintain supportability and stability for our managed Kubernetes service.

However, you can work around this limitation in the following two ways:

• Launch a privileged Init Container to set the value inside the container’s net namespace. Works with both namespaced and non-namespaced sysctls.
• Run a DaemonSet on every node with privileged containers and modify non-namespaced sysctls.

For example, you could launch the following Init Container:

initContainers:
  - command:
    - /bin/sh
    - -c
    - |
      sysctl -w net.core.somaxconn=10000
    image: busybox
    imagePullPolicy: Always
    name: init-sysctl
    resources: {}
    securityContext:
      privileged: true

Kubernetes does not allow any updates in securityContext unless it is a namespaced sysctl.

Related Topics

Why can't my VPC-native pods connect to my Droplets?

For Droplets created before 2 October 2024, you must manually add VPC peering routes to interconnect with VPC-native DOKS clusters

How to Troubleshoot Load Balancer Health Check Issues

Health checks often fail due to firewalls or misconfigured backend server software.

How can I improve the performance of cluster DNS?

Enable DNS caching, use non-shared machine types for the cluster, and scale out or reduce DNS traffic.