OCPBUGS-58313: pkg:add missing safe sysctls to list of SafeSysctlAllowlist

[jubittajohn]

As part of Kubernetes v1.32, several sysctls [1] have been added to the SafeSysctlAllowlist. However, that list has not yet been updated in OCP. This change addresses that issue.

[1] https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#safe-and-unsafe-sysctls

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci-robot]

@jubittajohn: This pull request references Jira Issue OCPBUGS-58313, which is invalid:

• expected the bug to target the "4.20.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

As part of Kubernetes v1.32, several sysctls [1] have been added to the SafeSysctlAllowlist. However, that list has not yet been updated in OCP. This change addresses that issue.

[1] https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#safe-and-unsafe-sysctls

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[jubittajohn]

/assign @bertinatto
I gave this a try. could you help review this change

[bertinatto]

/assign @ibihim
Krzystof, are you able to review this?

[bertinatto]

@jubittajohn can you create a proof PR (where you bump o/k to use your dev branch) to make sure this works as intended?

[jubittajohn]

@jubittajohn can you create a proof PR (where you bump o/k to use your dev branch) to make sure this works as intended?

openshift/kubernetes#2423

[ShazaAldawamneh]

/lgtm

[ShazaAldawamneh]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bertinatto, ibihim, jubittajohn, ShazaAldawamneh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [bertinatto]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bertinatto, ibihim, jubittajohn, ShazaAldawamneh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [bertinatto]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jubittajohn]

/jira refresh

[openshift-ci-robot]

@jubittajohn: This pull request references Jira Issue OCPBUGS-58313, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.21.0) matches configured target version for branch (4.21.0)
• bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @xingxingxia

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[xingxingxia]

The repo PR needs o/k repo to bump. So can't pre-merge verify. Only adding the label:
/verified later @xingxingxia

[openshift-ci-robot]

@xingxingxia: This PR has been marked to be verified later by @xingxingxia.

Details

In response to this:

The repo PR needs o/k repo to bump. So can't pre-merge verify. Only adding the label:
/verified later @xingxingxia

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@jubittajohn: Jira Issue OCPBUGS-58313: All pull requests linked via external trackers have merged:

• openshift/apiserver-library-go#148

This pull request has the verified-later tag and will need to be manually moved to VERIFIED after testing. Jira Issue OCPBUGS-58313 has been moved to the MODIFIED state.

Details

In response to this:

As part of Kubernetes v1.32, several sysctls [1] have been added to the SafeSysctlAllowlist. However, that list has not yet been updated in OCP. This change addresses that issue.

[1] https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#safe-and-unsafe-sysctls

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[jubittajohn]

/jira backport 4.20, 4.19, 4.18, 4.17, 4.16, 4.15, 4.14

[openshift-ci-robot]

@jubittajohn: The following backport issues have been created:

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick 4.20
/cherrypick 4.19
/cherrypick 4.18
/cherrypick 4.17
/cherrypick 4.16
/cherrypick 4.15
/cherrypick 4.14

Details

In response to this:

/jira backport 4.20, 4.19, 4.18, 4.17, 4.16, 4.15, 4.14

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-cherrypick-robot]

@openshift-ci-robot: cannot checkout 4.14: error checking out "4.14": exit status 1 error: pathspec '4.14' did not match any file(s) known to git

Details

In response to this:

@jubittajohn: The following backport issues have been created:

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick 4.20
/cherrypick 4.19
/cherrypick 4.18
/cherrypick 4.17
/cherrypick 4.16
/cherrypick 4.15
/cherrypick 4.14

In response to this:

/jira backport 4.20, 4.19, 4.18, 4.17, 4.16, 4.15, 4.14

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-cherrypick-robot]

@openshift-ci-robot: cannot checkout 4.15: error checking out "4.15": exit status 1 error: pathspec '4.15' did not match any file(s) known to git

Details

In response to this:

@jubittajohn: The following backport issues have been created:

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick 4.20
/cherrypick 4.19
/cherrypick 4.18
/cherrypick 4.17
/cherrypick 4.16
/cherrypick 4.15
/cherrypick 4.14

In response to this:

/jira backport 4.20, 4.19, 4.18, 4.17, 4.16, 4.15, 4.14

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-cherrypick-robot]

@openshift-ci-robot: cannot checkout 4.16: error checking out "4.16": exit status 1 error: pathspec '4.16' did not match any file(s) known to git

Details

In response to this:

@jubittajohn: The following backport issues have been created:

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick 4.20
/cherrypick 4.19
/cherrypick 4.18
/cherrypick 4.17
/cherrypick 4.16
/cherrypick 4.15
/cherrypick 4.14

In response to this:

/jira backport 4.20, 4.19, 4.18, 4.17, 4.16, 4.15, 4.14

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-cherrypick-robot]

@openshift-ci-robot: cannot checkout 4.17: error checking out "4.17": exit status 1 error: pathspec '4.17' did not match any file(s) known to git

Details

In response to this:

@jubittajohn: The following backport issues have been created:

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick 4.20
/cherrypick 4.19
/cherrypick 4.18
/cherrypick 4.17
/cherrypick 4.16
/cherrypick 4.15
/cherrypick 4.14

In response to this:

/jira backport 4.20, 4.19, 4.18, 4.17, 4.16, 4.15, 4.14

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-cherrypick-robot]

@openshift-ci-robot: cannot checkout 4.18: error checking out "4.18": exit status 1 error: pathspec '4.18' did not match any file(s) known to git

Details

In response to this:

@jubittajohn: The following backport issues have been created:

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick 4.20
/cherrypick 4.19
/cherrypick 4.18
/cherrypick 4.17
/cherrypick 4.16
/cherrypick 4.15
/cherrypick 4.14

In response to this:

/jira backport 4.20, 4.19, 4.18, 4.17, 4.16, 4.15, 4.14

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-cherrypick-robot]

@openshift-ci-robot: cannot checkout 4.19: error checking out "4.19": exit status 1 error: pathspec '4.19' did not match any file(s) known to git

Details

In response to this:

@jubittajohn: The following backport issues have been created:

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick 4.20
/cherrypick 4.19
/cherrypick 4.18
/cherrypick 4.17
/cherrypick 4.16
/cherrypick 4.15
/cherrypick 4.14

In response to this:

/jira backport 4.20, 4.19, 4.18, 4.17, 4.16, 4.15, 4.14

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-cherrypick-robot]

@openshift-ci-robot: cannot checkout 4.20: error checking out "4.20": exit status 1 error: pathspec '4.20' did not match any file(s) known to git

Details

In response to this:

@jubittajohn: The following backport issues have been created:

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick 4.20
/cherrypick 4.19
/cherrypick 4.18
/cherrypick 4.17
/cherrypick 4.16
/cherrypick 4.15
/cherrypick 4.14

In response to this:

/jira backport 4.20, 4.19, 4.18, 4.17, 4.16, 4.15, 4.14

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[jubittajohn]

/jira backport release-4.20, release-4.19, release-4.18, release-4.17, release-4.16, release-4.15, release-4.14

[openshift-ci-robot]

@jubittajohn: The following backport issues have been created:

• OCPBUGS-61679 for branch release-4.20
• OCPBUGS-61681 for branch release-4.19
• OCPBUGS-61682 for branch release-4.18
• OCPBUGS-61683 for branch release-4.17
• OCPBUGS-61684 for branch release-4.16
• OCPBUGS-61685 for branch release-4.15
• OCPBUGS-61686 for branch release-4.14

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick release-4.20
/cherrypick release-4.19
/cherrypick release-4.18
/cherrypick release-4.17
/cherrypick release-4.16
/cherrypick release-4.15
/cherrypick release-4.14

Details

In response to this:

/jira backport release-4.20, release-4.19, release-4.18, release-4.17, release-4.16, release-4.15, release-4.14

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-cherrypick-robot]

@openshift-ci-robot: #148 failed to apply on top of branch "release-4.14":

Applying: pkg:add missing safe sysctls to list of SafeSysctlAllowlist
Using index info to reconstruct a base tree...
M	pkg/securitycontextconstraints/sysctl/mustmatchpatterns.go
M	vendor/modules.txt
Falling back to patching base and 3-way merge...
Auto-merging vendor/modules.txt
Auto-merging pkg/securitycontextconstraints/sysctl/mustmatchpatterns.go
CONFLICT (content): Merge conflict in pkg/securitycontextconstraints/sysctl/mustmatchpatterns.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0001 pkg:add missing safe sysctls to list of SafeSysctlAllowlist

Details

In response to this:

@jubittajohn: The following backport issues have been created:

• OCPBUGS-61679 for branch release-4.20
• OCPBUGS-61681 for branch release-4.19
• OCPBUGS-61682 for branch release-4.18
• OCPBUGS-61683 for branch release-4.17
• OCPBUGS-61684 for branch release-4.16
• OCPBUGS-61685 for branch release-4.15
• OCPBUGS-61686 for branch release-4.14

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick release-4.20
/cherrypick release-4.19
/cherrypick release-4.18
/cherrypick release-4.17
/cherrypick release-4.16
/cherrypick release-4.15
/cherrypick release-4.14

In response to this:

/jira backport release-4.20, release-4.19, release-4.18, release-4.17, release-4.16, release-4.15, release-4.14

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.