Configuring interface-level network sysctls

    The main CNI plugin assigns the interface and passes this to the tuning CNI meta plugin at runtime. You can change some sysctls and several interface attributes (promiscuous mode, all-multicast mode, MTU, and MAC address) in the network namespace by using the tuning CNI meta plugin. In the tuning CNI meta plugin configuration, the interface name is represented by the token, and is replaced with the actual name of the interface at runtime.

    The following procedure configures the tuning CNI to change the interface-level network net.ipv4.conf.IFNAME.accept_redirects sysctl. This example enables accepting and sending ICMP-redirected packets.

    1. Create a network attachment definition, such as tuning-example.yaml, with the following content:

      An example yaml file is shown here:

      1. apiVersion: "k8s.cni.cncf.io/v1"
      2. kind: NetworkAttachmentDefinition
      3. metadata:
      4.   name: tuningnad
      5.   namespace: default
      6. spec:
      7.   config: '{
      8.     "cniVersion": "0.4.0",
      9.     "name": "tuningnad",
      10.     "plugins": [{
      11.       "type": "bridge"
      12.       },
      13.       {
      14.       "type": "tuning",
      15.       "sysctl": {
      16.         }
      18.   ]
      19. }'

    2. Apply the yaml by running the following command:

      1. $ oc apply -f tuning-example.yaml

      Example output

      1. apiVersion: v1
      2. kind: Pod
      3. metadata:
      4.   name: tunepod
      5.   namespace: default
      6.   annotations:
      7.     k8s.v1.cni.cncf.io/networks: tuningnad (1)
      8. spec:
      9.   containers:
      10.   - name: podexample
      11.     image: centos
      12.     securityContext:
      13.       runAsUser: 2000 (2)
      14.       runAsGroup: 3000 (3)
      16.       capabilities: (5)
      17.         drop: ["ALL"]
      18.   securityContext:
      19.     runAsNonRoot: true (6)
      20.     seccompProfile: (7)
      21.       type: RuntimeDefault

    4. Apply the yaml by running the following command:

      1. $ oc apply -f examplepod.yaml

    5. Verify that the pod is created by running the following command:

      Example output

      1. NAME      READY   STATUS    RESTARTS   AGE
      2. tunepod   1/1     Running   0          47s

    6. Log in to the pod by running the following command:

      1. $ oc rsh tunepod

    7. Expected output

      Additional resources