[sysctl] set fs.may_detach_mounts=1 even when CRIs don't set it themselves (#8635)

This commit is contained in:
Cristian Calin 2022-03-22 02:36:13 +02:00 committed by GitHub
parent ffa285c2e7
commit fa9f85c7e9
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

View file

@ -87,6 +87,24 @@
reload: yes reload: yes
when: enable_dual_stack_networks | bool when: enable_dual_stack_networks | bool
- name: Check if we need to set fs.may_detach_mounts
stat:
path: /proc/sys/fs/may_detach_mounts
get_attributes: no
get_checksum: no
get_mime: no
register: fs_may_detach_mounts
ignore_errors: true # noqa ignore-errors
- name: Set fs.may_detach_mounts if needed
sysctl:
sysctl_file: "{{ sysctl_file_path }}"
name: fs.may_detach_mounts
value: 1
state: present
reload: yes
when: fs_may_detach_mounts.stat.exists | d(false)
- name: Ensure kube-bench parameters are set - name: Ensure kube-bench parameters are set
sysctl: sysctl:
sysctl_file: "{{ sysctl_file_path }}" sysctl_file: "{{ sysctl_file_path }}"