Merge pull request #32383 from sttts/sttts-sysctl-infra-only

Automatic merge from submit-queue Only set sysctls for infra containers We did set the sysctls for each container in a pod. This opens up a way to set un-whitelisted sysctls during upgrade from v1.3: - set annotation in v1.3 with an un-whitelisted sysctl. Set restartPolicy=Always - upgrade cluster to v1.4 - kill container process - un-whitelisted sysctl is set on restart of the killed container.

Merge pull request #32383 from sttts/sttts-sysctl-infra-only
7d10cffc · Kubernetes Submit Queue · GitHub · 63954ccd · 962e7534 · 7d10cffc
Commit 7d10cffc authored Nov 01, 2016 by Kubernetes Submit Queue Committed by GitHub Nov 01, 2016
Hide whitespace changes
Inline Side-by-side

Showing with 13 additions and 11 deletions

docker_manager.go pkg/kubelet/dockertools/docker_manager.go +13 -11

No files found.
--- a/pkg/kubelet/dockertools/docker_manager.go
+++ b/pkg/kubelet/dockertools/docker_manager.go
@@ -688,18 +688,20 @@ func (dm *DockerManager) runContainer(
 	}
 	// Set sysctls if requested
-	sysctls, unsafeSysctls, err := api.SysctlsFromPodAnnotations(pod.Annotations)
+	if container.Name == PodInfraContainerName {
-	if err != nil {
+		sysctls, unsafeSysctls, err := api.SysctlsFromPodAnnotations(pod.Annotations)
-		dm.recorder.Eventf(ref, api.EventTypeWarning, events.FailedToCreateContainer, "Failed to create docker container %q of pod %q with error: %v", container.Name, format.Pod(pod), err)
+		if err != nil {
-		return kubecontainer.ContainerID{}, err
+			dm.recorder.Eventf(ref, api.EventTypeWarning, events.FailedToCreateContainer, "Failed to create docker container %q of pod %q with error: %v", container.Name, format.Pod(pod), err)
-	}
+			return kubecontainer.ContainerID{}, err
-	if len(sysctls)+len(unsafeSysctls) > 0 {
-		hc.Sysctls = make(map[string]string, len(sysctls)+len(unsafeSysctls))
-		for _, c := range sysctls {
-			hc.Sysctls[c.Name] = c.Value
 		}
-		for _, c := range unsafeSysctls {
+		if len(sysctls)+len(unsafeSysctls) > 0 {
-			hc.Sysctls[c.Name] = c.Value
+			hc.Sysctls = make(map[string]string, len(sysctls)+len(unsafeSysctls))
+			for _, c := range sysctls {
+				hc.Sysctls[c.Name] = c.Value
+			}
+			for _, c := range unsafeSysctls {
+				hc.Sysctls[c.Name] = c.Value
+			}
 		}
 	}