<p>For any future stumblers...</p>
<p>I solved the issue by creating <a href="https://kubernetes.io/docs/concepts/workloads/pods/init-containers/" rel="nofollow noreferrer">initContainers</a> block which allows any container to run before the pod's main container starts.</p>
<p>Since we are actually running commands on host os we need to run <code>initContainers</code> container in <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/" rel="nofollow noreferrer"><code>privileged</code> mode</a> (I may have added extra privilege arguments.. it works, I don't care).</p>
<p>Also we need to mount host os <code>/lib/modules</code> directory to container in order for <code>modprobe</code> command to modify host modules.</p>
<p>While experimenting, <code>initContainers</code> busybox container would fail and to check its fail output I would run this command:</p>
<pre class="lang-bash prettyprint-override"><code>kubectl logs --container='load-nfs' [YOUR_POD_FULL_NAME_HERE]
</code></pre>
<p>Here's my test yaml that works:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: ch1
  name: deployment-test
  namespace: default
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: test
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: test
    spec:
      containers:
        - image: strm/helloworld-http
          imagePullPolicy: Always
          name: test
          ports:
            - containerPort: 3000
              protocol: TCP
          resources:
            limits:
              cpu: &quot;1&quot;
              memory: 1Gi
            requests:
              cpu: 200m
              memory: 256Mi
      initContainers:
        - name: load-nfs
          image: busybox
          command: [&quot;sh&quot;, &quot;-c&quot;, &quot;modprobe nfs &amp;&amp; modprobe nfsd&quot;]
          volumeMounts:
            - mountPath: /lib/modules
              name: host-modules
          securityContext:
            runAsUser: 0
            privileged: true
            allowPrivilegeEscalation: true
            capabilities:
              add:
                - SYS_ADMIN
      volumes:
        - name: host-modules
          hostPath:
            path: /lib/modules
            type: Directory
</code></pre>

CC BY-SA 4.0
2023-02-27T08:48:41.550Z
Update: runAsUser should be 0 - root user as user 1000 throws forbidden
Brlja
CC BY-SA 4.0
2023-02-20T12:24:50.287Z
2023-02-27T08:47:47.100Z
2023-02-27T08:47:47.100Z
Brlja
<p>I'm having an issue with Google Cloud kubernetes node os image (container optimized image).<br />
Trouble is that one of the pods on the node is NFS server and node does not have nfs and nfsd kernel modules enabled on startup.<br />
So whenever the node restarts I need to ssh into it and run</p>
<pre class="lang-bash prettyprint-override"><code>sudo modprobe nfs
sudo modprobe nfsd
</code></pre>
<p>to enable required kernel modules.</p>
<p>How can I make this modules enabled by default when node restarts?</p>
<p>Thank you for your suggestions :-D</p>

<kubernetes><google-cloud-platform>
How to enable kernel modules by default on google cloud kubernetes node os image?
Brlja
# How to enable kernel modules by default on google cloud kubernetes node os image?

(Asked by: username_0 on 2023-02-20)

I'm having an issue with Google Cloud kubernetes node os image (container optimized image).
Trouble is that one of the pods on the node is NFS server and node does not have nfs and nfsd kernel modules enabled on startup.
So whenever the node restarts I need to ssh into it and run
sudo modprobe nfs
sudo modprobe nfsd

to enable required kernel modules.
How can I make this modules enabled by default when node restarts?
Thank you for your suggestions :-D

**Tags:** kubernetes, google-cloud-platform


---

## 1 answers

### Answer by username_0 on 2023-02-20. Score: 0 | Accepted answer

For any future stumblers...
I solved the issue by creating initContainers block which allows any container to run before the pod's main container starts.
Since we are actually running commands on host os we need to run initContainers container in privileged mode (I may have added extra privilege arguments.. it works, I don't care).
Also we need to mount host os /lib/modules directory to container in order for modprobe command to modify host modules.
While experimenting, initContainers busybox container would fail and to check its fail output I would run this command:
kubectl logs --container='load-nfs' [YOUR_POD_FULL_NAME_HERE]

Here's my test yaml that works:
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: ch1
  name: deployment-test
  namespace: default
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: test
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: test
    spec:
      containers:
        - image: strm/helloworld-http
          imagePullPolicy: Always
          name: test
          ports:
            - containerPort: 3000
              protocol: TCP
          resources:
            limits:
              cpu: "1"
              memory: 1Gi
            requests:
              cpu: 200m
              memory: 256Mi
      initContainers:
        - name: load-nfs
          image: busybox
          command: ["sh", "-c", "modprobe nfs && modprobe nfsd"]
          volumeMounts:
            - mountPath: /lib/modules
              name: host-modules
          securityContext:
            runAsUser: 0
            privileged: true
            allowPrivilegeEscalation: true
            capabilities:
              add:
                - SYS_ADMIN
      volumes:
        - name: host-modules
          hostPath:
            path: /lib/modules
            type: Directory

> **Comments:**
> **username_0**: Update: runAsUser should be 0 - root user as user 1000 throws forbidden  

---

