Skip to content

Commit

Permalink
Docs: Use docker.io/bash for sleep container of max-map-count-sette…
Browse files Browse the repository at this point in the history
…r Daemonset (#7332)

* Use `docker.io/bash` for sleep container of max-map-count-setter Daemonset

On GKE Autopilot the Daemonset only works if a `docker.io/bash` image is used for the sleep container. For other images trying to apply this gives the follwing error message:

```
Error from server (GKE Warden constraints violations): error when creating "daemonset.yaml": admission webhook "warden-validating.common-webhooks.networking.gke.io" denied the request: GKE Warden rejected the request because it violates one or more constraints.
Violations details: {"[denied by autogke-disallow-privilege]":["container max-map-count-setter is privileged; not allowed in Autopilot"]}
```

* Use latest docker.io/bash image for initContainer
  • Loading branch information
florianmutter committed Nov 24, 2023
1 parent e4bf28e commit e522406
Showing 1 changed file with 4 additions and 3 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -81,7 +81,7 @@ spec:
spec:
initContainers:
- name: max-map-count-setter
image: docker.io/bash:5.2.15
image: docker.io/bash:5.2.21
resources:
limits:
cpu: 100m
Expand All @@ -92,7 +92,8 @@ spec:
command: ['/usr/local/bin/bash', '-e', '-c', 'echo 262144 > /proc/sys/vm/max_map_count']
containers:
- name: sleep
image: gcr.io/google-containers/pause-amd64:3.2
image: docker.io/bash:5.2.21
command: ['sleep', 'infinity']
EOF
----

Expand Down Expand Up @@ -122,4 +123,4 @@ spec:
- name: max-map-count-check
command: ['sh', '-c', "while true; do mmc=$(cat /proc/sys/vm/max_map_count); if [ ${mmc} -eq 262144 ]; then exit 0; fi; sleep 1; done"]
EOF
----
----

0 comments on commit e522406

Please sign in to comment.