<p>I am somewhat new to k8 and I am trying to utilise the helmchart to start up opensearch.</p>
<p>My setup is as follows:</p>
<ul>
<li>XUbuntu 24.04(Running in virtualbox)</li>
<li>Rancher 1.15.0</li>
<li>k8 - 1.30.3</li>
<li>Opentofu 1.8.1</li>
</ul>
<p>Looking at the documentation the I realise the <em>kubernetes_pod_security_policy</em> has been deprecated as of k8 1.25. However I am not sure how else to go about enabling unsafe sysctls.</p>
<p>Listed below are the opentofu helm resource I am using and the values.yml I am overriding:</p>
<pre><code>resource &quot;helm_release&quot; &quot;opensearch&quot; {
  name        = &quot;opensearch&quot;
  namespace   = kubernetes_namespace.monitoring.metadata.0.name
  repository  = &quot;https://opensearch-project.github.io/helm-charts&quot;
  chart       = &quot;opensearch&quot;
  version     = &quot;2.22.0&quot;

  values = [
    &quot;${file(&quot;opensearch.yml&quot;)}&quot;
  ]

  depends_on = [helm_release.traefik]
}
</code></pre>
<p>and opensearch.yml:</p>
<pre><code>extraEnvs:
  - name: OPENSEARCH_INITIAL_ADMIN_PASSWORD
    value: yourStrongPassword123
plugins:
  security:
    ssl:
      http:
        enabled: false
persistance:
  enabled: false
sysctl:
  enabled: true
sysctlInit:
  enabled: true
initResources:
  limits:
     cpu: &quot;1000m&quot;
     memory: &quot;900Mi&quot;
  requests:
     cpu: &quot;25m&quot;
     memory: &quot;128Mi&quot;
</code></pre>
<p>Listing the pods I can see the following indicating the sysctl has not been configured</p>
<pre><code>opensearch-cluster-master-0                                0/1     Terminating       0          0s
opensearch-cluster-master-2                                0/1     SysctlForbidden   0          0s
</code></pre>
<p>from the events in k8:</p>
<pre><code>29s         Warning   SysctlForbidden         pod/opensearch-cluster-master-2                                               forbidden sysctl: &quot;vm.max_map_count&quot; not allowlisted
28s         Warning   SysctlForbidden         pod/opensearch-cluster-master-2                                               forbidden sysctl: &quot;vm.max_map_count&quot; not allowlisted
28s         Normal    Scheduled               pod/opensearch-cluster-master-2                                               Successfully assigned monitoring/opensearch-cluster-master-2 to lima-rancher-desktop
27s         Normal    Scheduled               pod/opensearch-cluster-master-2                                               Successfully assigned monitoring/opensearch-cluster-master-2 to lima-rancher-desktop
27s         Warning   SysctlForbidden         pod/opensearch-cluster-master-2                                               forbidden sysctl: &quot;vm.max_map_count&quot; not allowlisted

</code></pre>
<p>Any assistance would be greatly appreciated</p>

CC BY-SA 4.0
2024-08-15T12:13:20.170Z
you can follow [this issue](https://github.com/opensearch-project/helm-charts/issues/87) to fix it.
Arta Asadi
CC BY-SA 4.0
2024-08-16T10:10:03.657Z
Many thanks Arta. Much appreciated
user3465651
<kubernetes><terraform>
Struggling to enable unsafe sysctl for opensearch in k8
user3465651
# Struggling to enable unsafe sysctl for opensearch in k8

(Asked by: username_0 on 2024-08-12)

I am somewhat new to k8 and I am trying to utilise the helmchart to start up opensearch.
My setup is as follows:

XUbuntu 24.04(Running in virtualbox)
Rancher 1.15.0
k8 - 1.30.3
Opentofu 1.8.1

Looking at the documentation the I realise the kubernetes_pod_security_policy has been deprecated as of k8 1.25. However I am not sure how else to go about enabling unsafe sysctls.
Listed below are the opentofu helm resource I am using and the values.yml I am overriding:
resource "helm_release" "opensearch" {
  name        = "opensearch"
  namespace   = kubernetes_namespace.monitoring.metadata.0.name
  repository  = "https://opensearch-project.github.io/helm-charts"
  chart       = "opensearch"
  version     = "2.22.0"

  values = [
    "${file("opensearch.yml")}"
  ]

  depends_on = [helm_release.traefik]
}

and opensearch.yml:
extraEnvs:
  - name: OPENSEARCH_INITIAL_ADMIN_PASSWORD
    value: yourStrongPassword123
plugins:
  security:
    ssl:
      http:
        enabled: false
persistance:
  enabled: false
sysctl:
  enabled: true
sysctlInit:
  enabled: true
initResources:
  limits:
     cpu: "1000m"
     memory: "900Mi"
  requests:
     cpu: "25m"
     memory: "128Mi"

Listing the pods I can see the following indicating the sysctl has not been configured
opensearch-cluster-master-0                                0/1     Terminating       0          0s
opensearch-cluster-master-2                                0/1     SysctlForbidden   0          0s

from the events in k8:
29s         Warning   SysctlForbidden         pod/opensearch-cluster-master-2                                               forbidden sysctl: "vm.max_map_count" not allowlisted
28s         Warning   SysctlForbidden         pod/opensearch-cluster-master-2                                               forbidden sysctl: "vm.max_map_count" not allowlisted
28s         Normal    Scheduled               pod/opensearch-cluster-master-2                                               Successfully assigned monitoring/opensearch-cluster-master-2 to lima-rancher-desktop
27s         Normal    Scheduled               pod/opensearch-cluster-master-2                                               Successfully assigned monitoring/opensearch-cluster-master-2 to lima-rancher-desktop
27s         Warning   SysctlForbidden         pod/opensearch-cluster-master-2                                               forbidden sysctl: "vm.max_map_count" not allowlisted


Any assistance would be greatly appreciated

**Tags:** kubernetes, terraform

> **Comments:**
> **username_1**: you can follow [this issue](https://github.com/opensearch-project/helm-charts/issues/87) to fix it.  
> **username_0**: Many thanks Arta. Much appreciated  

---

## 0 answers

