Body: <p>I am somewhat new to k8 and I am trying to utilise the helmchart to start up opensearch.</p>
  <p>My setup is as follows:</p>
  <ul>
  <li>XUbuntu 24.04(Running in virtualbox)</li>
  <li>Rancher 1.15.0</li>
  <li>k8 - 1.30.3</li>
  <li>Opentofu 1.8.1</li>
  </ul>
  <p>Looking at the documentation the I realise the <em>kubernetes_pod_security_policy</em> has been deprecated as of k8 1.25. However I am not sure how else to go about enabling unsafe sysctls.</p>
  <p>Listed below are the opentofu helm resource I am using and the values.yml I am overriding:</p>
  <pre><code>resource &quot;helm_release&quot; &quot;opensearch&quot; {
    name        = &quot;opensearch&quot;
    namespace   = kubernetes_namespace.monitoring.metadata.0.name
    repository  = &quot;https://opensearch-project.github.io/helm-charts&quot;
    chart       = &quot;opensearch&quot;
    version     = &quot;2.22.0&quot;
  
    values = [
      &quot;${file(&quot;opensearch.yml&quot;)}&quot;
    ]
  
    depends_on = [helm_release.traefik]
  }
  </code></pre>
  <p>and opensearch.yml:</p>
  <pre><code>extraEnvs:
    - name: OPENSEARCH_INITIAL_ADMIN_PASSWORD
      value: yourStrongPassword123
  plugins:
    security:
      ssl:
        http:
          enabled: false
  persistance:
    enabled: false
  sysctl:
    enabled: true
  sysctlInit:
    enabled: true
  initResources:
    limits:
       cpu: &quot;1000m&quot;
       memory: &quot;900Mi&quot;
    requests:
       cpu: &quot;25m&quot;
       memory: &quot;128Mi&quot;
  </code></pre>
  <p>Listing the pods I can see the following indicating the sysctl has not been configured</p>
  <pre><code>opensearch-cluster-master-0                                0/1     Terminating       0          0s
  opensearch-cluster-master-2                                0/1     SysctlForbidden   0          0s
  </code></pre>
  <p>from the events in k8:</p>
  <pre><code>29s         Warning   SysctlForbidden         pod/opensearch-cluster-master-2                                               forbidden sysctl: &quot;vm.max_map_count&quot; not allowlisted
  28s         Warning   SysctlForbidden         pod/opensearch-cluster-master-2                                               forbidden sysctl: &quot;vm.max_map_count&quot; not allowlisted
  28s         Normal    Scheduled               pod/opensearch-cluster-master-2                                               Successfully assigned monitoring/opensearch-cluster-master-2 to lima-rancher-desktop
  27s         Normal    Scheduled               pod/opensearch-cluster-master-2                                               Successfully assigned monitoring/opensearch-cluster-master-2 to lima-rancher-desktop
  27s         Warning   SysctlForbidden         pod/opensearch-cluster-master-2                                               forbidden sysctl: &quot;vm.max_map_count&quot; not allowlisted
  
  </code></pre>
  <p>Any assistance would be greatly appreciated</p>
  
Comments: CC BY-SA 4.0
Comments: 2024-08-15T12:13:20.170Z
Comments: you can follow [this issue](https://github.com/opensearch-project/helm-charts/issues/87) to fix it.
Comments: Arta Asadi
Comments: CC BY-SA 4.0
Comments: 2024-08-16T10:10:03.657Z
Comments: Many thanks Arta. Much appreciated
Comments: user3465651
Tags: <kubernetes><terraform>
Title: Struggling to enable unsafe sysctl for opensearch in k8
UserDisplayName: user3465651
ThreadText: # Struggling to enable unsafe sysctl for opensearch in k8
  
  (Asked by: username_0 on 2024-08-12)
  
  I am somewhat new to k8 and I am trying to utilise the helmchart to start up opensearch.
  
  My setup is as follows:
  
  * XUbuntu 24.04(Running in virtualbox)
  * Rancher 1.15.0
  * k8 - 1.30.3
  * Opentofu 1.8.1
  
  Looking at the documentation the I realise the *kubernetes\_pod\_security\_policy* has been deprecated as of k8 1.25. However I am not sure how else to go about enabling unsafe sysctls.
  
  Listed below are the opentofu helm resource I am using and the values.yml I am overriding:
  
  ```
  resource "helm_release" "opensearch" {
    name        = "opensearch"
    namespace   = kubernetes_namespace.monitoring.metadata.0.name
    repository  = "https://opensearch-project.github.io/helm-charts"
    chart       = "opensearch"
    version     = "2.22.0"
  
    values = [
      "${file("opensearch.yml")}"
    ]
  
    depends_on = [helm_release.traefik]
  }
  
  ```
  
  and opensearch.yml:
  
  ```
  extraEnvs:
    - name: OPENSEARCH_INITIAL_ADMIN_PASSWORD
      value: yourStrongPassword123
  plugins:
    security:
      ssl:
        http:
          enabled: false
  persistance:
    enabled: false
  sysctl:
    enabled: true
  sysctlInit:
    enabled: true
  initResources:
    limits:
       cpu: "1000m"
       memory: "900Mi"
    requests:
       cpu: "25m"
       memory: "128Mi"
  
  ```
  
  Listing the pods I can see the following indicating the sysctl has not been configured
  
  ```
  opensearch-cluster-master-0                                0/1     Terminating       0          0s
  opensearch-cluster-master-2                                0/1     SysctlForbidden   0          0s
  
  ```
  
  from the events in k8:
  
  ```
  29s         Warning   SysctlForbidden         pod/opensearch-cluster-master-2                                               forbidden sysctl: "vm.max_map_count" not allowlisted
  28s         Warning   SysctlForbidden         pod/opensearch-cluster-master-2                                               forbidden sysctl: "vm.max_map_count" not allowlisted
  28s         Normal    Scheduled               pod/opensearch-cluster-master-2                                               Successfully assigned monitoring/opensearch-cluster-master-2 to lima-rancher-desktop
  27s         Normal    Scheduled               pod/opensearch-cluster-master-2                                               Successfully assigned monitoring/opensearch-cluster-master-2 to lima-rancher-desktop
  27s         Warning   SysctlForbidden         pod/opensearch-cluster-master-2                                               forbidden sysctl: "vm.max_map_count" not allowlisted
  
  ```
  
  Any assistance would be greatly appreciated
  
  **Tags:** kubernetes, terraform
  
  > **Comments:**
  > **username_1**: you can follow [this issue](https://github.com/opensearch-project/helm-charts/issues/87) to fix it.  
  > **username_0**: Many thanks username_1. Much appreciated  
  
  ---
  
  ## 0 answers
  
  