openshift/openshift-docs
1
0
Fork 0
mirror of https://github.com/openshift/openshift-docs.git synced 2026-02-05 12:46:18 +01:00
Code Issues Releases Activity
Files
400a0199bdcd125efc50997a7eab6ec1c07eb2b5
openshift-docs/modules/nodes-nodes-kernel-arguments.adoc

164 lines
7.8 KiB
Plaintext
Raw Blame History

// Module included in the following assemblies:
//
// * nodes/nodes-nodes-managing.adoc
// * machine_configuration/machine-configs-configure.adoc
:_mod-docs-content-type: PROCEDURE
[id="nodes-nodes-kernel-arguments_{context}"]
= Adding kernel arguments to nodes
In some special cases, you might want to add kernel arguments to a set of nodes in your cluster. This should only be done with caution and clear understanding of the implications of the arguments you set.
[WARNING]
====
Improper use of kernel arguments can result in your systems becoming unbootable.
====
Examples of kernel arguments you could set include:
* **nosmt**: Disables symmetric multithreading (SMT) in the kernel. Multithreading allows multiple logical threads for each CPU. You could consider `nosmt` in multi-tenant environments to reduce risks from potential cross-thread attacks. By disabling SMT, you essentially choose security over performance.
* **enforcing=0**: Configures Security Enhanced Linux (SELinux) to run in permissive mode. In permissive mode, the system acts as if SELinux is enforcing the loaded security policy, including labeling objects and emitting access denial entries in the logs, but it does not actually deny any operations. While not supported for production systems, permissive mode can be helpful for debugging.
+
[WARNING]
====
Disabling SELinux on {op-system} in production is not supported.
Once SELinux has been disabled on a node, it must be re-provisioned before re-inclusion in a production cluster.
====
See link:https://www.kernel.org/doc/Documentation/admin-guide/kernel-parameters.txt[Kernel.org kernel parameters] for a list and descriptions of kernel arguments.
In the following procedure, you create a `MachineConfig` object that identifies:
* A set of machines to which you want to add the kernel argument. In this case, machines with a worker role.
* Kernel arguments that are appended to the end of the existing kernel arguments.
* A label that indicates where in the list of machine configs the change is applied.
.Prerequisites
* Have administrative privilege to a working {product-title} cluster.
.Procedure
. List existing `MachineConfig` objects for your {product-title} cluster to determine how to
label your machine config:
+
[source,terminal]
----
$ oc get MachineConfig
----
+
.Example output
[source,terminal]
----
NAME GENERATEDBYCONTROLLER IGNITIONVERSION AGE
00-master 52dd3ba6a9a527fc3ab42afac8d12b693534c8c9 3.5.0 33m
00-worker 52dd3ba6a9a527fc3ab42afac8d12b693534c8c9 3.5.0 33m
01-master-container-runtime 52dd3ba6a9a527fc3ab42afac8d12b693534c8c9 3.5.0 33m
01-master-kubelet 52dd3ba6a9a527fc3ab42afac8d12b693534c8c9 3.5.0 33m
01-worker-container-runtime 52dd3ba6a9a527fc3ab42afac8d12b693534c8c9 3.5.0 33m
01-worker-kubelet 52dd3ba6a9a527fc3ab42afac8d12b693534c8c9 3.5.0 33m
99-master-generated-registries 52dd3ba6a9a527fc3ab42afac8d12b693534c8c9 3.5.0 33m
99-master-ssh 3.2.0 40m
99-worker-generated-registries 52dd3ba6a9a527fc3ab42afac8d12b693534c8c9 3.5.0 33m
99-worker-ssh 3.2.0 40m
rendered-master-23e785de7587df95a4b517e0647e5ab7 52dd3ba6a9a527fc3ab42afac8d12b693534c8c9 3.5.0 33m
rendered-worker-5d596d9293ca3ea80c896a1191735bb1 52dd3ba6a9a527fc3ab42afac8d12b693534c8c9 3.5.0 33m
----
. Create a `MachineConfig` object file that identifies the kernel argument (for example, `05-worker-kernelarg-selinuxpermissive.yaml`)
+
[source,yaml]
----
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
labels:
machineconfiguration.openshift.io/role: worker<1>
name: 05-worker-kernelarg-selinuxpermissive<2>
spec:
kernelArguments:
- enforcing=0<3>
----
+
<1> Applies the new kernel argument only to worker nodes.
<2> Named to identify where it fits among the machine configs (05) and what it does (adds
a kernel argument to configure SELinux permissive mode).
<3> Identifies the exact kernel argument as `enforcing=0`.
. Create the new machine config:
+
[source,terminal]
----
$ oc create -f 05-worker-kernelarg-selinuxpermissive.yaml
----
. Check the machine configs to see that the new one was added:
+
[source,terminal]
----
$ oc get MachineConfig
----
+
.Example output
[source,terminal]
----
NAME GENERATEDBYCONTROLLER IGNITIONVERSION AGE
00-master 52dd3ba6a9a527fc3ab42afac8d12b693534c8c9 3.5.0 33m
00-worker 52dd3ba6a9a527fc3ab42afac8d12b693534c8c9 3.5.0 33m
01-master-container-runtime 52dd3ba6a9a527fc3ab42afac8d12b693534c8c9 3.5.0 33m
01-master-kubelet 52dd3ba6a9a527fc3ab42afac8d12b693534c8c9 3.5.0 33m
01-worker-container-runtime 52dd3ba6a9a527fc3ab42afac8d12b693534c8c9 3.5.0 33m
01-worker-kubelet 52dd3ba6a9a527fc3ab42afac8d12b693534c8c9 3.5.0 33m
05-worker-kernelarg-selinuxpermissive 3.5.0 105s
99-master-generated-registries 52dd3ba6a9a527fc3ab42afac8d12b693534c8c9 3.5.0 33m
99-master-ssh 3.2.0 40m
99-worker-generated-registries 52dd3ba6a9a527fc3ab42afac8d12b693534c8c9 3.5.0 33m
99-worker-ssh 3.2.0 40m
rendered-master-23e785de7587df95a4b517e0647e5ab7 52dd3ba6a9a527fc3ab42afac8d12b693534c8c9 3.5.0 33m
rendered-worker-5d596d9293ca3ea80c896a1191735bb1 52dd3ba6a9a527fc3ab42afac8d12b693534c8c9 3.5.0 33m
----
. Check the nodes:
+
[source,terminal]
----
$ oc get nodes
----
+
.Example output
[source,terminal]
----
NAME STATUS ROLES AGE VERSION
ip-10-0-136-161.ec2.internal Ready worker 28m v1.33.4
ip-10-0-136-243.ec2.internal Ready master 34m v1.33.4
ip-10-0-141-105.ec2.internal Ready,SchedulingDisabled worker 28m v1.33.4
ip-10-0-142-249.ec2.internal Ready master 34m v1.33.4
ip-10-0-153-11.ec2.internal Ready worker 28m v1.33.4
ip-10-0-153-150.ec2.internal Ready master 34m v1.33.4
----
+
You can see that scheduling on each worker node is disabled as the change is being applied.
. Check that the kernel argument worked by going to one of the worker nodes and listing
the kernel command-line arguments (in `/proc/cmdline` on the host):
+
[source,terminal]
----
$ oc debug node/ip-10-0-141-105.ec2.internal
----
+
.Example output
[source,terminal]
----
Starting pod/ip-10-0-141-105ec2internal-debug ...
To use host binaries, run `chroot /host`
sh-4.2# cat /host/proc/cmdline
BOOT_IMAGE=/ostree/rhcos-... console=tty0 console=ttyS0,115200n8
rootflags=defaults,prjquota rw root=UUID=fd0... ostree=/ostree/boot.0/rhcos/16...
coreos.oem.id=qemu coreos.oem.id=ec2 ignition.platform.id=ec2 enforcing=0
sh-4.2# exit
----
+
You should see the `enforcing=0` argument added to the other kernel arguments.
View Git Blame Copy Permalink