/test pull-kubernetes-e2e-gce-ubuntu-containerd

/sig api-machinery

/remove-sig api-machinery

Eg, you could /retitle Add support for slash as sysctl separator to Pod securityContext field and to PodSecurityPolicy

Thanks for your suggestion, it has been changed.

are there minimum kernel / container runtime / OS versions required for slash-delimited sysctl support?

There are few articles on the Internet about linux sysctl separators, so I also checked the source code of the linux kernel part to verify.

linux kernel support sysctl:
sysctl appeared in 1.3.57 and is fully supported ever since.

/proc/sys
              This directory (present since 1.3.57) contains a number of
              files and subdirectories corresponding to kernel
              variables.  These variables can be read and in some cases
              modified using the /proc filesystem, and the (deprecated)
              [sysctl(2)](https://man7.org/linux/man-pages/man2/sysctl.2.html) system call.

              String values may be terminated by either '\0' or '\n'.

              Integer and long values may be written either in decimal
              or in hexadecimal notation (e.g., 0x3FFF).  When writing
              multiple integer or long values, these may be separated by
              any of the following whitespace characters: ' ', '\t', or
              '\n'.  Using other separators leads to the error EINVAL.

ref:

• https://man7.org/linux/man-pages/man5/proc.5.html
• https://www.linuxjournal.com/article/2365
• source code: https://mirrors.edge.kernel.org/pub/linux/kernel/v1.3/linux-1.3.57.tar.gz

The sysctl also uses the conversion of slashes and dot separator ,at least 10 years ago. I found the source code of procps-ng Sysctl, the earliest version is 3.3.0 I can found, and the conversion of . and / has been implemented at this time, at least 10 years ago（Maybe earlier, but I can't find the source code further forward）.

if so, what is the impact of using a slash-delimited sysctl on a node/kernel/os/container runtime that doesn't support slash-delimited sysctls?
is the impact limited to an error running the container, or can it cause problems beyond the scope of that container?

I think that the kernel versions generally used now are greater than version 1.35.7, and the bottom layer of the kernel supports sysctl including slashes.

As far as my own understanding is concerned, the linux kernel finally needs to convert dots into slashes to find files under /proc/sys, so it must support slashes.

The runc code opencontainers/runc@f7d1401 only adds namespace verification to sysctl, and then uses syscall to call sysctl in 2015.

The runc code just adds namespace verification to sysctl, and then calls sysctl.

runc 1.1.0 allow slashes in sysctl names, to better match sysctl(8)'s behaviour. (opencontainers/runc#3254, opencontainers/runc#3257)

In order to be compatible with runc which does not support slashes to separate namespaces and keys, I have converted the slashes into dot separators before the kubelet calls runc.

So I don't think it has effect on k8s already using sysctl functionality.
However, I am not very familiar with the linux kernel source code, maybe someone who is more familiar with this part of the code can help to confirm it again? @liggitt

/milestone v1.25

/retest

/lgtm
move to Done in sig-node board.

Please review again. @liggitt @lavalamp

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liggitt, mengjiao-liu, mrunalp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

/hold cancel

/test pull-kubernetes-e2e-kind