Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Change/add params to support CIS scan #1295

Merged
merged 3 commits into from
Apr 14, 2021
Merged

Change/add params to support CIS scan #1295

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0881890
release: update kernel panic settings
felipeac Feb 15, 2021
748a3ea
kubernetes: adjust kernel overcommit settings
felipeac Feb 15, 2021
63774ff
kubernetes: set readOnlyPort and protectKernelDefaults
felipeac Feb 15, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions packages/kubernetes-1.15/kubelet-config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,11 +44,13 @@ kubeReserved:
ephemeral-storage: "{{default "1Gi" settings.kubernetes.kube-reserved.ephemeral-storage}}"
resolvConf: "/etc/resolv.conf"
hairpinMode: hairpin-veth
readOnlyPort: 0
cgroupDriver: systemd
cgroupRoot: "/"
runtimeRequestTimeout: 15m
featureGates:
RotateKubeletServerCertificate: true
protectKernelDefaults: true
serializeImagePulls: false
serverTLSBootstrap: true
configMapAndSecretChangeDetectionStrategy: Cache
Expand Down
2 changes: 2 additions & 0 deletions packages/kubernetes-1.15/kubelet-sysctl.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
# Overcommit handling mode - 1: Always overcommit
vm.overcommit_memory = 1
5 changes: 5 additions & 0 deletions packages/kubernetes-1.15/kubernetes-1.15.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ Source5: kubernetes-ca-crt
Source6: kubelet-exec-start-conf
Source7: kubelet-bootstrap-kubeconfig
Source8: kubernetes-tmpfiles.conf
Source9: kubelet-sysctl.conf
Source1000: clarify.toml
Patch1: 0001-always-set-relevant-variables-for-cross-compiling.patch

Expand Down Expand Up @@ -92,6 +93,9 @@ ln -rs \
%{buildroot}%{_sharedstatedir}/kubelet/plugins \
%{buildroot}%{_cross_libexecdir}/kubernetes/kubelet-plugins

mkdir -p %{buildroot}%{_cross_sysctldir}
install -p -m 0644 %{S:9} %{buildroot}%{_cross_sysctldir}/90-kubelet.conf

%cross_scan_attribution --clarify %{S:1000} go-vendor vendor

%files -n %{_cross_os}kubelet-1.15
Expand All @@ -110,5 +114,6 @@ ln -rs \
%{_cross_tmpfilesdir}/kubernetes.conf
%dir %{_cross_libexecdir}/kubernetes
%{_cross_libexecdir}/kubernetes/kubelet-plugins
%{_cross_sysctldir}/90-kubelet.conf

%changelog
2 changes: 2 additions & 0 deletions packages/kubernetes-1.16/kubelet-config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,11 +44,13 @@ kubeReserved:
ephemeral-storage: "{{default "1Gi" settings.kubernetes.kube-reserved.ephemeral-storage}}"
resolvConf: "/etc/resolv.conf"
hairpinMode: hairpin-veth
readOnlyPort: 0
cgroupDriver: systemd
cgroupRoot: "/"
runtimeRequestTimeout: 15m
featureGates:
RotateKubeletServerCertificate: true
protectKernelDefaults: true
serializeImagePulls: false
serverTLSBootstrap: true
configMapAndSecretChangeDetectionStrategy: Cache
Expand Down
2 changes: 2 additions & 0 deletions packages/kubernetes-1.16/kubelet-sysctl.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
# Overcommit handling mode - 1: Always overcommit
vm.overcommit_memory = 1
5 changes: 5 additions & 0 deletions packages/kubernetes-1.16/kubernetes-1.16.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ Source5: kubernetes-ca-crt
Source6: kubelet-exec-start-conf
Source7: kubelet-bootstrap-kubeconfig
Source8: kubernetes-tmpfiles.conf
Source9: kubelet-sysctl.conf
Source1000: clarify.toml
Patch1: 0001-always-set-relevant-variables-for-cross-compiling.patch

Expand Down Expand Up @@ -88,6 +89,9 @@ ln -rs \
%{buildroot}%{_sharedstatedir}/kubelet/plugins \
%{buildroot}%{_cross_libexecdir}/kubernetes/kubelet-plugins

mkdir -p %{buildroot}%{_cross_sysctldir}
install -p -m 0644 %{S:9} %{buildroot}%{_cross_sysctldir}/90-kubelet.conf

%cross_scan_attribution --clarify %{S:1000} go-vendor vendor

%files -n %{_cross_os}kubelet-1.16
Expand All @@ -106,5 +110,6 @@ ln -rs \
%{_cross_tmpfilesdir}/kubernetes.conf
%dir %{_cross_libexecdir}/kubernetes
%{_cross_libexecdir}/kubernetes/kubelet-plugins
%{_cross_sysctldir}/90-kubelet.conf

%changelog
2 changes: 2 additions & 0 deletions packages/kubernetes-1.17/kubelet-config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,12 +44,14 @@ kubeReserved:
ephemeral-storage: "{{default "1Gi" settings.kubernetes.kube-reserved.ephemeral-storage}}"
resolvConf: "/etc/resolv.conf"
hairpinMode: hairpin-veth
readOnlyPort: 0
cgroupDriver: systemd
cgroupRoot: "/"
runtimeRequestTimeout: 15m
featureGates:
RotateKubeletServerCertificate: true
CSIMigration: false
protectKernelDefaults: true
serializeImagePulls: false
serverTLSBootstrap: true
configMapAndSecretChangeDetectionStrategy: Cache
Expand Down
2 changes: 2 additions & 0 deletions packages/kubernetes-1.17/kubelet-sysctl.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
# Overcommit handling mode - 1: Always overcommit
vm.overcommit_memory = 1
5 changes: 5 additions & 0 deletions packages/kubernetes-1.17/kubernetes-1.17.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ Source5: kubernetes-ca-crt
Source6: kubelet-exec-start-conf
Source7: kubelet-bootstrap-kubeconfig
Source8: kubernetes-tmpfiles.conf
Source9: kubelet-sysctl.conf
Source1000: clarify.toml
Patch1: 0001-always-set-relevant-variables-for-cross-compiling.patch

Expand Down Expand Up @@ -88,6 +89,9 @@ ln -rs \
%{buildroot}%{_sharedstatedir}/kubelet/plugins \
%{buildroot}%{_cross_libexecdir}/kubernetes/kubelet-plugins

mkdir -p %{buildroot}%{_cross_sysctldir}
install -p -m 0644 %{S:9} %{buildroot}%{_cross_sysctldir}/90-kubelet.conf

%cross_scan_attribution --clarify %{S:1000} go-vendor vendor

%files -n %{_cross_os}kubelet-1.17
Expand All @@ -106,5 +110,6 @@ ln -rs \
%{_cross_tmpfilesdir}/kubernetes.conf
%dir %{_cross_libexecdir}/kubernetes
%{_cross_libexecdir}/kubernetes/kubelet-plugins
%{_cross_sysctldir}/90-kubelet.conf

%changelog
2 changes: 2 additions & 0 deletions packages/kubernetes-1.18/kubelet-config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,12 +44,14 @@ kubeReserved:
ephemeral-storage: "{{default "1Gi" settings.kubernetes.kube-reserved.ephemeral-storage}}"
resolvConf: "/etc/resolv.conf"
hairpinMode: hairpin-veth
readOnlyPort: 0
cgroupDriver: systemd
cgroupRoot: "/"
runtimeRequestTimeout: 15m
featureGates:
RotateKubeletServerCertificate: true
CSIMigration: false
protectKernelDefaults: true
tjkirch marked this conversation as resolved.
Show resolved Hide resolved
serializeImagePulls: false
serverTLSBootstrap: true
configMapAndSecretChangeDetectionStrategy: Cache
Expand Down
2 changes: 2 additions & 0 deletions packages/kubernetes-1.18/kubelet-sysctl.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
# Overcommit handling mode - 1: Always overcommit
vm.overcommit_memory = 1
5 changes: 5 additions & 0 deletions packages/kubernetes-1.18/kubernetes-1.18.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ Source5: kubernetes-ca-crt
Source6: kubelet-exec-start-conf
Source7: kubelet-bootstrap-kubeconfig
Source8: kubernetes-tmpfiles.conf
Source9: kubelet-sysctl.conf
Source1000: clarify.toml
Patch1: 0001-always-set-relevant-variables-for-cross-compiling.patch

Expand Down Expand Up @@ -85,6 +86,9 @@ ln -rs \
%{buildroot}%{_sharedstatedir}/kubelet/plugins \
%{buildroot}%{_cross_libexecdir}/kubernetes/kubelet-plugins

mkdir -p %{buildroot}%{_cross_sysctldir}
install -p -m 0644 %{S:9} %{buildroot}%{_cross_sysctldir}/90-kubelet.conf

%cross_scan_attribution --clarify %{S:1000} go-vendor vendor

%files -n %{_cross_os}kubelet-1.18
Expand All @@ -103,5 +107,6 @@ ln -rs \
%{_cross_tmpfilesdir}/kubernetes.conf
%dir %{_cross_libexecdir}/kubernetes
%{_cross_libexecdir}/kubernetes/kubelet-plugins
%{_cross_sysctldir}/90-kubelet.conf

%changelog
2 changes: 2 additions & 0 deletions packages/kubernetes-1.19/kubelet-config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,12 +44,14 @@ kubeReserved:
ephemeral-storage: "{{default "1Gi" settings.kubernetes.kube-reserved.ephemeral-storage}}"
resolvConf: "/etc/resolv.conf"
hairpinMode: hairpin-veth
readOnlyPort: 0
cgroupDriver: systemd
cgroupRoot: "/"
runtimeRequestTimeout: 15m
featureGates:
RotateKubeletServerCertificate: true
CSIMigration: false
protectKernelDefaults: true
serializeImagePulls: false
serverTLSBootstrap: true
configMapAndSecretChangeDetectionStrategy: Cache
Expand Down
2 changes: 2 additions & 0 deletions packages/kubernetes-1.19/kubelet-sysctl.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
# Overcommit handling mode - 1: Always overcommit
vm.overcommit_memory = 1
5 changes: 5 additions & 0 deletions packages/kubernetes-1.19/kubernetes-1.19.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ Source5: kubernetes-ca-crt
Source6: kubelet-exec-start-conf
Source7: kubelet-bootstrap-kubeconfig
Source8: kubernetes-tmpfiles.conf
Source9: kubelet-sysctl.conf
Source1000: clarify.toml
Patch1: 0001-always-set-relevant-variables-for-cross-compiling.patch

Expand Down Expand Up @@ -82,6 +83,9 @@ ln -rs \
%{buildroot}%{_sharedstatedir}/kubelet/plugins \
%{buildroot}%{_cross_libexecdir}/kubernetes/kubelet-plugins

mkdir -p %{buildroot}%{_cross_sysctldir}
install -p -m 0644 %{S:9} %{buildroot}%{_cross_sysctldir}/90-kubelet.conf

%cross_scan_attribution --clarify %{S:1000} go-vendor vendor

%files -n %{_cross_os}kubelet-1.19
Expand All @@ -100,5 +104,6 @@ ln -rs \
%{_cross_tmpfilesdir}/kubernetes.conf
%dir %{_cross_libexecdir}/kubernetes
%{_cross_libexecdir}/kubernetes/kubelet-plugins
%{_cross_sysctldir}/90-kubelet.conf

%changelog
7 changes: 5 additions & 2 deletions packages/release/release-sysctl.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,11 @@
# Maximize console logging level for kernel printk messages
kernel.printk = 8 4 1 7

# Wait 30 seconds and then reboot
kernel.panic = 30
# Wait 10 seconds and then reboot
kernel.panic = 10
bcressey marked this conversation as resolved.
Show resolved Hide resolved

# Controls the kernel's behaviour when an oops or BUG is encountered
kernel.panic_on_oops = 1

# Allow neighbor cache entries to expire even when the cache is not full
net.ipv4.neigh.default.gc_thresh1 = 0
Expand Down