0

I'm having an issue with Google Cloud kubernetes node os image (container optimized image).
Trouble is that one of the pods on the node is NFS server and node does not have nfs and nfsd kernel modules enabled on startup.
So whenever the node restarts I need to ssh into it and run

sudo modprobe nfs
sudo modprobe nfsd

to enable required kernel modules.

How can I make this modules enabled by default when node restarts?

Thank you for your suggestions :-D

1 Answer 1

0

For any future stumblers...

I solved the issue by creating initContainers block which allows any container to run before the pod's main container starts.

Since we are actually running commands on host os we need to run initContainers container in privileged mode (I may have added extra privilege arguments.. it works, I don't care).

Also we need to mount host os /lib/modules directory to container in order for modprobe command to modify host modules.

While experimenting, initContainers busybox container would fail and to check its fail output I would run this command:

kubectl logs --container='load-nfs' [YOUR_POD_FULL_NAME_HERE]

Here's my test yaml that works:

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: ch1
  name: deployment-test
  namespace: default
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: test
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: test
    spec:
      containers:
        - image: strm/helloworld-http
          imagePullPolicy: Always
          name: test
          ports:
            - containerPort: 3000
              protocol: TCP
          resources:
            limits:
              cpu: "1"
              memory: 1Gi
            requests:
              cpu: 200m
              memory: 256Mi
      initContainers:
        - name: load-nfs
          image: busybox
          command: ["sh", "-c", "modprobe nfs && modprobe nfsd"]
          volumeMounts:
            - mountPath: /lib/modules
              name: host-modules
          securityContext:
            runAsUser: 0
            privileged: true
            allowPrivilegeEscalation: true
            capabilities:
              add:
                - SYS_ADMIN
      volumes:
        - name: host-modules
          hostPath:
            path: /lib/modules
            type: Directory
1
  • Update: runAsUser should be 0 - root user as user 1000 throws forbidden
    – Brlja
    Feb 27, 2023 at 8:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.