Chapter 15. Configuring interface-level network sysctls

Procedure

1. Create a network attachment definition, such as tuning-example.yaml, with the following content:

   apiVersion: "k8s.cni.cncf.io/v1"
   kind: NetworkAttachmentDefinition
   metadata:
     name: <name> 

   1

   
     namespace: default 

   2

   
   spec:
     config: '{
       "cniVersion": "0.4.0", 

   3

   
       "name": "<name>", 

   4

   
       "plugins": [{
          "type": "<main_CNI_plugin>" 

   5

   
         },
         {
          "type": "tuning", 

   6

   
          "sysctl": {
               "net.ipv4.conf.IFNAME.accept_redirects": "1" 

   7

   
           }
         }
        ]
   }

   Copy to Clipboard

   1

   Specifies the name for the additional network attachment to create. The name must be unique within the specified namespace.

   2

   Specifies the namespace that the object is associated with.

   3

   Specifies the CNI specification version.

   4

   Specifies the name for the configuration. It is recommended to match the configuration name to the name value of the network attachment definition.

   5

   Specifies the name of the main CNI plugin to configure.

   6

   Specifies the name of the CNI meta plugin.

   7

   Specifies the sysctl to set.

   An example yaml file is shown here:

   apiVersion: "k8s.cni.cncf.io/v1"
   kind: NetworkAttachmentDefinition
   metadata:
     name: tuningnad
     namespace: default
   spec:
     config: '{
       "cniVersion": "0.4.0",
       "name": "tuningnad",
       "plugins": [{
         "type": "bridge"
         },
         {
         "type": "tuning",
         "sysctl": {
            "net.ipv4.conf.IFNAME.accept_redirects": "1"
           }
       }
     ]
   }'

   Copy to Clipboard

2. Apply the yaml by running the following command:

   $ oc apply -f tuning-example.yaml

   Copy to Clipboard

   Example output

   networkattachmentdefinition.k8.cni.cncf.io/tuningnad created

   Copy to Clipboard

3. Create a pod such as examplepod.yaml with the network attachment definition similar to the following:

   apiVersion: v1
   kind: Pod
   metadata:
     name: tunepod
     namespace: default
     annotations:
       k8s.v1.cni.cncf.io/networks: tuningnad 

   1

   
   spec:
     containers:
     - name: podexample
       image: centos
       command: ["/bin/bash", "-c", "sleep INF"]
       securityContext:
         runAsUser: 2000 

   2

   
         runAsGroup: 3000 

   3

   
         allowPrivilegeEscalation: false 

   4

   
         capabilities: 

   5

   
           drop: ["ALL"]
     securityContext:
       runAsNonRoot: true 

   6

   
       seccompProfile: 

   7

   
         type: RuntimeDefault

   Copy to Clipboard

   1

   Specify the name of the configured NetworkAttachmentDefinition.

   2

   runAsUser controls which user ID the container is run with.

   3

   runAsGroup controls which primary group ID the containers is run with.

   4

   allowPrivilegeEscalation determines if a pod can request to allow privilege escalation. If unspecified, it defaults to true. This boolean directly controls whether the no_new_privs flag gets set on the container process.

   5

   capabilities permit privileged actions without giving full root access. This policy ensures all capabilities are dropped from the pod.

   6

   runAsNonRoot: true requires that the container will run with a user with any UID other than 0.

   7

   RuntimeDefault enables the default seccomp profile for a pod or container workload.

4. Apply the yaml by running the following command:

   $ oc apply -f examplepod.yaml

   Copy to Clipboard

5. Verify that the pod is created by running the following command:

   $ oc get pod

   Copy to Clipboard

   Example output

   NAME      READY   STATUS    RESTARTS   AGE
   tunepod   1/1     Running   0          47s

   Copy to Clipboard

6. Log in to the pod by running the following command:

   $ oc rsh tunepod

   Copy to Clipboard

7. Verify the values of the configured sysctl flags. For example, find the value net.ipv4.conf.net1.accept_redirects by running the following command:

   sh-4.4# sysctl net.ipv4.conf.net1.accept_redirects

   Copy to Clipboard

   Expected output

   net.ipv4.conf.net1.accept_redirects = 1

   Copy to Clipboard