mirror of
https://github.com/siderolabs/talos.git
synced 2025-12-12 04:51:35 +01:00
e08b4f8f9e
Fixed: https://github.com/talos-systems/talos/issues/3686 Replaced sequencer tasks for KSPP and Kubernetes required sysctl props by the ones set by controllers. KernelParam flow includes of 3 controllers and 2 resources: - `KernelParamConfigController` - handles user sysctls coming from v1alpha1 config. - `KernelParamDefaultsController` - handles our built-in KSPP and K8s required sysctls. - `KernelParamSpecController` - consumes `KernelParamSpec`s created by the previous two controllers, applies them and updates the corresponding `KernelParamStatus`. Signed-off-by: Artem Chernyshev <artem.0xD2@gmail.com>
87 lines
2.3 KiB
Go
87 lines
2.3 KiB
Go
// This Source Code Form is subject to the terms of the Mozilla Public
|
|
// License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
// file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
|
|
package kspp
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"github.com/hashicorp/go-multierror"
|
|
"github.com/talos-systems/go-procfs/procfs"
|
|
|
|
"github.com/talos-systems/talos/pkg/kernel"
|
|
)
|
|
|
|
// RequiredKSPPKernelParameters is the set of kernel parameters required to
|
|
// satisfy the KSPP.
|
|
var RequiredKSPPKernelParameters = procfs.Parameters{
|
|
// init_on_alloc and init_on_free are not enforced, as they default to '1' in kernel config
|
|
// this way they can be overridden via installer extra args in case of severe performance issues
|
|
// procfs.NewParameter("init_on_alloc").Append("1"),
|
|
// procfs.NewParameter("init_on_free").Append("1"),
|
|
procfs.NewParameter("slab_nomerge").Append(""),
|
|
procfs.NewParameter("pti").Append("on"),
|
|
}
|
|
|
|
// EnforceKSPPKernelParameters verifies that all required KSPP kernel
|
|
// parameters are present with the right value.
|
|
func EnforceKSPPKernelParameters() error {
|
|
var result *multierror.Error
|
|
|
|
for _, values := range RequiredKSPPKernelParameters {
|
|
var val *string
|
|
if val = procfs.ProcCmdline().Get(values.Key()).First(); val == nil {
|
|
result = multierror.Append(result, fmt.Errorf("KSPP kernel parameter %s is required", values.Key()))
|
|
|
|
continue
|
|
}
|
|
|
|
expected := values.First()
|
|
if *val != *expected {
|
|
result = multierror.Append(result, fmt.Errorf("KSPP kernel parameter %s was found with value %s, expected %s", values.Key(), *val, *expected))
|
|
}
|
|
}
|
|
|
|
return result.ErrorOrNil()
|
|
}
|
|
|
|
// GetKernelParams returns the list of KSPP kernels.
|
|
func GetKernelParams() []*kernel.Param {
|
|
return []*kernel.Param{
|
|
{
|
|
Key: "kernel.kptr_restrict",
|
|
Value: "1",
|
|
},
|
|
{
|
|
Key: "kernel.dmesg_restrict",
|
|
Value: "1",
|
|
},
|
|
{
|
|
Key: "kernel.perf_event_paranoid",
|
|
Value: "3",
|
|
},
|
|
// We can skip this kernel because CONFIG_KEXEC is not set.
|
|
// {
|
|
// Key: "kernel.kexec_load_disabled",
|
|
// Value: "1",
|
|
// },
|
|
{
|
|
Key: "kernel.yama.ptrace_scope",
|
|
Value: "1",
|
|
},
|
|
{
|
|
Key: "user.max_user_namespaces",
|
|
Value: "0",
|
|
},
|
|
{
|
|
Key: "kernel.unprivileged_bpf_disabled",
|
|
Value: "1",
|
|
},
|
|
{
|
|
Key: "net.core.bpf_jit_harden",
|
|
Value: "2",
|
|
},
|
|
}
|
|
}
|