All of StackState's own components can run without any extra permissions. However, StackState uses Elasticsearch, and there are some additional requirements for the nodes that this runs on.
vm.max_map_count Linux system setting is usually lower than required for Elasticsearch to start, an init container is used that runs in privileged mode and as the root user. The init container is enabled by default to allow the
vm.max_map_count system setting to be changed.
In case you and/or your Kubernetes administrators do not want the privileged Elasticsearch init container to be enabled by default, you can disable this behavior in the file
values.yaml used to install StackState:
To inspect the current
vm.max_map_count setting, run the following command. Note that it runs a privileged pod:
kubectl run -i --tty sysctl-check-max-map-count --privileged=true --image=busybox --restart=Never --rm=true -- sysctl vm.max_map_count
If the current
vm.max_map_count setting is not at least
262144, it will need to be increased in a different way or Elasticsearch will fail to start up and its pods will be in a restart loop. The logs will contain an error message like this:
bootstrap checks failedmax virtual memory areas vm.max_map_count  is too low, increase to at least 
Depending on what your Kubernetes administrators prefer, the
vm.max_map_count can be set to a higher default on all nodes by either changing the default node configuration (for example via init scripts) or by having a DaemonSet do this right after node startup. The former is very dependent on your Kuberentes cluster setup, so there are no general solutions there.
Below is an example that can be used as a starting point for a DaemonSet to change the
apiVersion: apps/v1kind: DaemonSetmetadata:name: set-vm-max-map-countlabels:k8s-app: set-vm-max-map-countspec:selector:matchLabels:name: set-vm-max-map-counttemplate:metadata:labels:name: set-vm-max-map-countspec:# Make sure the setting always gets changed as soon as possible:tolerations:- effect: NoScheduleoperator: Exists- effect: NoExecutekey: node.kubernetes.io/not-readyoperator: Exists# Optional node selector (assumes nodes for Elasticsearch are labeled `elastichsearch:yes`# nodeSelector:# elasticsearch: yesinitContainers:- name: set-vm-max-map-countimage: busyboxsecurityContext:runAsUser: 0privileged: truecommand: ["sysctl", "-w", "vm.max_map_count=262144"]resources:limits:cpu: 100mmemory: 100Mirequests:cpu: 100mmemory: 100Mi# A pause container is needed to prevent a restart loop of the pods in the daemonset# See also this Kuberentes issue https://github.com/kubernetes/kubernetes/issues/36601containers:- name: pauseimage: google/pauseresources:limits:cpu: 50mmemory: 50Mirequests:cpu: 50mmemory: 50Mi
To limit the number of nodes that this is applied to, nodes can be labeled. NodeSelectors on both this DaemonSet, as shown in the example, and the Elasticsearch deployment can then be set to run only on nodes with the specific label. For Elasticsearch, the node selector can be specified via the values:
elasticsearch:nodeSelector:elasticsearch: yessysctlInitContainer:enabled: false