KEP-5996: Add KEP initial README by VeraQin · Pull Request #5998 · kubernetes/enhancements

VeraQin · 2026-04-07T04:27:07Z

One-line PR description: Add the KEP doc with proposal, design and initial plans.

Issue link: Support Default Pod Sysctls in Kubelet #5996

Other comments: N/A

linux-foundation-easycla · 2026-04-07T04:27:15Z

The committers listed above are authorized under a signed CLA.

✅ login: VeraQin / name: VeraQin (dd7007c)

k8s-ci-robot · 2026-04-07T04:27:17Z

Welcome @VeraQin!

It looks like this is your first PR to kubernetes/enhancements 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/enhancements has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2026-04-07T04:27:18Z

Hi @VeraQin. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-ci-robot · 2026-04-07T04:27:19Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: VeraQin
Once this PR has been reviewed and has the lgtm label, please assign derekwaynecarr for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

keps/sig-node/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

…guration.

SergeyKanzhelev · 2026-04-07T21:12:57Z

/ok-to-test

SergeyKanzhelev · 2026-04-07T21:14:00Z

keps/sig-node/5996-default-pod-sysctls/kep.yaml

+
+# The following PRR answers are required at beta release
+metrics:
+  - TBD


just remove the metrics section

unless we need metrics for some PRR. But I think simple failed pod metrics spike can be used for it

SergeyKanzhelev · 2026-04-07T21:17:20Z

keps/sig-node/5996-default-pod-sysctls/README.md

+    * Cover list: `kernel.shm*`, `kernel.msg*`, `kernel.sem`, `fs.mqueue.*`, `net.*`, `kernel.domainname`, `user.*`.
+* Ensure that sysctls are only applied if the pod is namespaced for the corresponding subsystem (i.e., not using HostNetwork or HostIPC).
+
+### Non-Goals


add non-goal to not include any additional filtering on which Pods those default will apply to. For e.g. we do not want to have per-Pod-namespace sets of sysctls

(not in this version at least)

k8s-ci-robot · 2026-04-07T21:17:32Z

@VeraQin: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-enhancements-test	`dd7007c`	link	true	`/test pull-enhancements-test`
pull-enhancements-verify	`dd7007c`	link	true	`/test pull-enhancements-verify`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

SergeyKanzhelev · 2026-04-07T21:18:40Z

keps/sig-node/5996-default-pod-sysctls/README.md

+
+#### Story 1
+
+As a cluster admin, I would like to be able to set namespaced sysctls for all pods to share the same kernel environments. And pods keep the ability to customize specific sysctl in its own namespace.


for me this is too broad of a user story. Can you give example with the specific sysclt that system administrator may need to adjust across all Pods and why

SergeyKanzhelev · 2026-04-07T21:20:26Z

keps/sig-node/5996-default-pod-sysctls/README.md

+Currently, Kubernetes allows users to specify sysctls for individual pods via the [securityContext.sysctls](https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#setting-sysctls-for-a-pod) field in the Pod spec. However, in many production environments, node administrators often need to enforce consistent kernel parameter tuning across all workloads on a node or within a node pool/group. For example, high-performance networking or messaging applications may require specific `net.*` or `kernel.shm*` values to be set globally for all containers on specialized nodes.
+Setting these parameters manually in every Pod spec is error-prone and redundant. Furthermore, cluster operators may wish to manage these defaults at the infrastructure level (e.g., via Kubelet configuration) to ensure performance and stability without requiring application developers to be aware of the underlying host kernel tuning needs.
+
+### Goals


specify that static pods are also in-scope. Mentioning them explicitly helps to not forget to add tests for them

SergeyKanzhelev · 2026-04-07T21:29:44Z

keps/sig-node/5996-default-pod-sysctls/README.md

+
+The field will be guarded by a new feature gate called `DefaultPodSysctls` added in [kube_features.go](https://github.com/kubernetes/kubernetes/blob/master/pkg/features/kube_features.go).
+
+The namespace-level verification will be performed while applying to pods in `Application Logic` below, since it depends on the pod namespace information. Unnamespaced flags will be ignored silently to avoid failure.


Let's say there will be a log message at least, not completely silently.

I am not quite sure that the right way is to ignore instead of failing fast. Failing fast will help detect the configuration issue.

Also I would suggest to fail on non-existing sysctls - if cluster admin made a typo, they likely want to know about it

SergeyKanzhelev · 2026-04-07T21:32:50Z

keps/sig-node/5996-default-pod-sysctls/README.md

+}
+```
+
+### Validation


I think it general, we want to have early validation on kubelet as aligned with container runtime as possible. Basically making it the same as just passing everything to the container runtime.

SergeyKanzhelev · 2026-04-07T21:33:51Z

keps/sig-node/5996-default-pod-sysctls/kep.yaml

+  - "@SergeyKanzhelev"
+  - "@BenTheElder"
+approvers:
+  - TBD


approvers will be assigned at the KEP triage

k8s-ci-robot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Apr 7, 2026

k8s-ci-robot requested a review from derekwaynecarr April 7, 2026 04:27

k8s-ci-robot added the kind/kep Categorizes KEP tracking issues and PRs modifying the KEP directory label Apr 7, 2026

k8s-ci-robot requested a review from mrunalp April 7, 2026 04:27

k8s-ci-robot added sig/node Categorizes an issue or PR as relevant to SIG Node. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Apr 7, 2026

Add KEP doc for kep-5996 support default pod sysctls in kubelet confi…

dd7007c

…guration.

VeraQin force-pushed the master branch from 597df3c to dd7007c Compare April 7, 2026 04:31

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Apr 7, 2026

SergeyKanzhelev mentioned this pull request Apr 7, 2026

Support Default Pod Sysctls in Kubelet #5996

Open

4 tasks

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Apr 7, 2026

SergeyKanzhelev reviewed Apr 7, 2026

View reviewed changes


		#### Story 1

		As a cluster admin, I would like to be able to set namespaced sysctls for all pods to share the same kernel environments. And pods keep the ability to customize specific sysctl in its own namespace.


		The field will be guarded by a new feature gate called `DefaultPodSysctls` added in [kube_features.go](https://github.com/kubernetes/kubernetes/blob/master/pkg/features/kube_features.go).

		The namespace-level verification will be performed while applying to pods in `Application Logic` below, since it depends on the pod namespace information. Unnamespaced flags will be ignored silently to avoid failure.

Conversation

VeraQin commented Apr 7, 2026

Uh oh!

linux-foundation-easycla bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented Apr 7, 2026

Uh oh!

k8s-ci-robot commented Apr 7, 2026

Uh oh!

k8s-ci-robot commented Apr 7, 2026

Uh oh!

SergeyKanzhelev commented Apr 7, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

k8s-ci-robot commented Apr 7, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

linux-foundation-easycla bot commented Apr 7, 2026 •

edited

Loading