I was going through a tutorial that said
Ensure you are using Kubernetes 1.10+ and the following settings are enabled: Feature-gate PodShareProcessNamespace=true is turned on for both apiserver and kubelet
I have searched online but am unable to find any way to turn on feature-gates for a kubelet. Some sites have suggested editing /etc/kuberenetes/kubelet.env but I don't seem to have that file on my cluster.
So what is the right way to enable feature gates for a kubelet?
Edit: (Adding more details as per comment)
My goal is to run perf on a cluster through sidecar injection. For the same I need to enable kubelet and kube-apiserver feature-gate "PodShareProcessNamespace=true". This is the tutorial I tried following
I am working on a digitalocean unmanaged 3 worker - 1 master cluster.
I have never used kuberenetes outside minikube before and so I may be asking a very dumb or obvious question. In addition I am not very clear on what exactly a feature-gate
is so that may be the reason my question isn't making much sense
I have found the answer somewhere else but I will post it here so that other people with similar question may find it helpful.
Unless you want to enable feature-gates in a running cluster without restarting there was no need for all those complicated gymnastics. You simply need to edit the yaml file and redeploy the pod.
In the yaml file for the pod you want to profile with perf you need to add ShareProcessNamespace: true
under the container
section. For pods like perf which need privileged system calls you also need to set privileged: true
. This is an example yaml for profiling a pod
apiVersion: v1
kind: Pod
metadata:
name: test-pod
spec:
shareProcessNamespace: true
containers:
- name: mongo
image: mongo
- name: perf
image: <some dockerhubrepo>/perf
securityContext:
privileged: true
capabilities:
add:
- SYS_PTRACE
tty: true
stdin: true
note that the perf repo I used is just a simple pod with perf installed on it which has a python script with infinite sleep loop running just to prevent it from being terminated. to profile you could either
OR