-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
SLE platforms use drop in file for sysctl variables for SLE platforms #10367
SLE platforms use drop in file for sysctl variables for SLE platforms #10367
Conversation
Instead of modifying the global /etc/sysctl.conf file for each one of them Modification recommended by system engineers with the motivation, this approach provides cleaner setup for support and upgrade the system
Hi @teacup-on-rockingchair. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
I believe this approach would be good for other products as well. If so, we can remove the conditional for |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@teacup-on-rockingchair Do you plan to make the changes to Ansible as well?
And please, update the behavior of the template in the documentation as well.
Just to be sure we are on the same page here, to update the documentation that for sle the sysctl configuration goes into a var-specific file right? yuumasato: Sorry, I edited your comment by mistake |
Yes. |
Code Climate has analyzed commit d14940f and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 51.8% (-0.1% change). View more on Code Climate. |
Instead of using per product logn conditions in templates and rules/fixes, use property defined on per product basis. Thanks to @yuumasato for the hint
c1d8884
to
ab54b42
Compare
Add note on sysctl_remediate_drop_in_file property
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@teacup-on-rockingchair Thank you for adding the property.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you for adding the template customization property.
Based on #10417, I'm waving |
In ComplianceAsCode#10367 the sysctl template was updated to check whether a sysctl is set on /usr/lib/sysctl.d without being overwritten. kernel.kptr_restrict is set to 1 by default in /usr/lib/sysctl.d/50-redhat.conf Before, the template didn't check for sysctls in that path and resulted in Fail evaluation, requiring remediation.
Description:
Rationale: