Answers: <p>For any future stumblers...</p>
  <p>I solved the issue by creating <a href="https://kubernetes.io/docs/concepts/workloads/pods/init-containers/" rel="nofollow noreferrer">initContainers</a> block which allows any container to run before the pod's main container starts.</p>
  <p>Since we are actually running commands on host os we need to run <code>initContainers</code> container in <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/" rel="nofollow noreferrer"><code>privileged</code> mode</a> (I may have added extra privilege arguments.. it works, I don't care).</p>
  <p>Also we need to mount host os <code>/lib/modules</code> directory to container in order for <code>modprobe</code> command to modify host modules.</p>
  <p>While experimenting, <code>initContainers</code> busybox container would fail and to check its fail output I would run this command:</p>
  <pre class="lang-bash prettyprint-override"><code>kubectl logs --container='load-nfs' [YOUR_POD_FULL_NAME_HERE]
  </code></pre>
  <p>Here's my test yaml that works:</p>
  <pre class="lang-yaml prettyprint-override"><code>apiVersion: apps/v1
  kind: Deployment
  metadata:
    labels:
      app: ch1
    name: deployment-test
    namespace: default
  spec:
    progressDeadlineSeconds: 600
    replicas: 1
    revisionHistoryLimit: 10
    selector:
      matchLabels:
        app: test
    strategy:
      rollingUpdate:
        maxSurge: 25%
        maxUnavailable: 25%
      type: RollingUpdate
    template:
      metadata:
        labels:
          app: test
      spec:
        containers:
          - image: strm/helloworld-http
            imagePullPolicy: Always
            name: test
            ports:
              - containerPort: 3000
                protocol: TCP
            resources:
              limits:
                cpu: &quot;1&quot;
                memory: 1Gi
              requests:
                cpu: 200m
                memory: 256Mi
        initContainers:
          - name: load-nfs
            image: busybox
            command: [&quot;sh&quot;, &quot;-c&quot;, &quot;modprobe nfs &amp;&amp; modprobe nfsd&quot;]
            volumeMounts:
              - mountPath: /lib/modules
                name: host-modules
            securityContext:
              runAsUser: 0
              privileged: true
              allowPrivilegeEscalation: true
              capabilities:
                add:
                  - SYS_ADMIN
        volumes:
          - name: host-modules
            hostPath:
              path: /lib/modules
              type: Directory
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2023-02-27T08:48:41.550Z
Answers: Update: runAsUser should be 0 - root user as user 1000 throws forbidden
Answers: Brlja
Answers: CC BY-SA 4.0
Answers: 2023-02-20T12:24:50.287Z
Answers: 2023-02-27T08:47:47.100Z
Answers: 2023-02-27T08:47:47.100Z
Answers: Brlja
Body: <p>I'm having an issue with Google Cloud kubernetes node os image (container optimized image).<br />
  Trouble is that one of the pods on the node is NFS server and node does not have nfs and nfsd kernel modules enabled on startup.<br />
  So whenever the node restarts I need to ssh into it and run</p>
  <pre class="lang-bash prettyprint-override"><code>sudo modprobe nfs
  sudo modprobe nfsd
  </code></pre>
  <p>to enable required kernel modules.</p>
  <p>How can I make this modules enabled by default when node restarts?</p>
  <p>Thank you for your suggestions :-D</p>
  
Tags: <kubernetes><google-cloud-platform>
Title: How to enable kernel modules by default on google cloud kubernetes node os image?
UserDisplayName: Brlja
ThreadText: # How to enable kernel modules by default on google cloud kubernetes node os image?
  
  (Asked by: username_0 on 2023-02-20)
  
  I'm having an issue with Google Cloud kubernetes node os image (container optimized image).  
  Trouble is that one of the pods on the node is NFS server and node does not have nfs and nfsd kernel modules enabled on startup.  
  So whenever the node restarts I need to ssh into it and run
  
  ```bash
  sudo modprobe nfs
  sudo modprobe nfsd
  
  ```
  
  to enable required kernel modules.
  
  How can I make this modules enabled by default when node restarts?
  
  Thank you for your suggestions :-D
  
  **Tags:** kubernetes, google-cloud-platform
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2023-02-20. Score: 0 | Accepted answer
  
  For any future stumblers...
  
  I solved the issue by creating [initContainers](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) block which allows any container to run before the pod's main container starts.
  
  Since we are actually running commands on host os we need to run `initContainers` container in [`privileged` mode](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) (I may have added extra privilege arguments.. it works, I don't care).
  
  Also we need to mount host os `/lib/modules` directory to container in order for `modprobe` command to modify host modules.
  
  While experimenting, `initContainers` busybox container would fail and to check its fail output I would run this command:
  
  ```bash
  kubectl logs --container='load-nfs' [YOUR_POD_FULL_NAME_HERE]
  
  ```
  
  Here's my test yaml that works:
  
  ```yaml
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    labels:
      app: ch1
    name: deployment-test
    namespace: default
  spec:
    progressDeadlineSeconds: 600
    replicas: 1
    revisionHistoryLimit: 10
    selector:
      matchLabels:
        app: test
    strategy:
      rollingUpdate:
        maxSurge: 25%
        maxUnavailable: 25%
      type: RollingUpdate
    template:
      metadata:
        labels:
          app: test
      spec:
        containers:
          - image: strm/helloworld-http
            imagePullPolicy: Always
            name: test
            ports:
              - containerPort: 3000
                protocol: TCP
            resources:
              limits:
                cpu: "1"
                memory: 1Gi
              requests:
                cpu: 200m
                memory: 256Mi
        initContainers:
          - name: load-nfs
            image: busybox
            command: ["sh", "-c", "modprobe nfs && modprobe nfsd"]
            volumeMounts:
              - mountPath: /lib/modules
                name: host-modules
            securityContext:
              runAsUser: 0
              privileged: true
              allowPrivilegeEscalation: true
              capabilities:
                add:
                  - SYS_ADMIN
        volumes:
          - name: host-modules
            hostPath:
              path: /lib/modules
              type: Directory
  
  ```
  
  > **Comments:**
  > **username_0**: Update: runAsUser should be 0 - root user as user 1000 throws forbidden  
  
  ---
  
  