Skip to content

Commit 4f0d457

Browse files
StephenJamesSmithStephenJamesSmith
committed
TELCODOCS-1823: Dev review
1 parent e81e2a6 commit 4f0d457

File tree

4 files changed

+161
-1
lines changed

4 files changed

+161
-1
lines changed

‎hardware_enablement/kmm-kernel-module-management.adoc

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,20 @@ include::modules/kmm-installing-using-web-console.adoc[leveloffset=+2]
1616
include::modules/kmm-installing-using-cli.adoc[leveloffset=+2]
1717
include::modules/kmm-installing-older-versions.adoc[leveloffset=+2]
1818

19+
// Added for TELCODOCS-1823
20+
include::modules/kmm-configuring-kmmo.adoc[leveloffset=+1]
21+
[role="_additional-resources"]
22+
.Additional resources
23+
24+
* For more information, see xref:../hardware_enablement/kmm-kernel-module-management.adoc#kmm-install_kernel-module-management-operator[Installing the Kernel Module Management Operator].
25+
26+
include::modules/kmm-unloading-kernel-module.adoc[leveloffset=+2]
27+
include::modules/kmm-setting-kernel-firmware-search-path.adoc[leveloffset=+2]
28+
[role="_additional-resources"]
29+
.Additional resources
30+
31+
* For more information about the `worker.setFirmwareClassPath` path, see xref:../hardware_enablement/kmm-kernel-module-management.adoc#kmm-configuring-kmmo_kernel-module-management-operator[Configuring the Kernel Module Management Operator].
32+
1933
// Added for TELCODOCS-1309
2034
include::modules/kmm-uninstalling-kmm.adoc[leveloffset=+1]
2135
include::modules/kmm-uninstalling-kmmo-red-hat-catalog.adoc[leveloffset=+2]
@@ -26,7 +40,7 @@ include::modules/kmm-creating-module-cr.adoc[leveloffset=+2]
2640
2741
// Added for TELCODOCS-1280
2842
include::modules/kmm-setting-soft-dependencies-between-kernel-modules.adoc[leveloffset=+2]
29-
include::modules/kmm-security.adoc[leveloffset=+2]
43+
include::modules/kmm-security.adoc[leveloffset=+1]
3044
3145
[role="_additional-resources"]
3246
.Additional resources

‎modules/kmm-configuring-kmmo.adoc

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * hardware_enablement/kmm-kernel-module-management.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="kmm-configuring-kmmo_{context}"]
7+
= Configuring the Kernel Module Management Operator
8+
9+
In most cases, the default configuration for the Kernel Module Management (KMM) Operator does not need to be modified. However, you can modify the Operator settings to suit your environment using the following procedure.
10+
11+
The Operator configuration is set in the `kmm-operator-manager-config` `ConfigMap` in the Operator namespace.
12+
13+
.Procedure
14+
15+
. To modify the settings, edit the `ConfigMap` data by entering the following command:
16+
+
17+
[source,terminal]
18+
----
19+
$ oc edit configmap -n "$namespace" kmm-operator-manager-config
20+
----
21+
+
22+
.Example output
23+
+
24+
[source,yaml]
25+
----
26+
healthProbeBindAddress: :8081
27+
leaderElection:
28+
enabled: true
29+
resourceID: kmm.sigs.x-k8s.io
30+
webhook:
31+
disableHTTP2: true # CVE-2023-44487
32+
port: 9443
33+
metrics:
34+
enableAuthnAuthz: true
35+
disableHTTP2: true # CVE-2023-44487
36+
bindAddress: 0.0.0.0:8443
37+
secureServing: true
38+
worker:
39+
runAsUser: 0
40+
seLinuxType: spc_t
41+
setFirmwareClassPath: /var/lib/firmware
42+
----
43+
+
44+
.Operator configuration parameters
45+
[cols="2,8",options="header"]
46+
|===
47+
|Parameter |Description
48+
49+
| `healthProbeBindAddress`
50+
| Defines the address on which the Operator monitors for kubelet health probes. The recommended value is `:8081`.
51+
52+
|`leaderElection.enabled`
53+
|Determines whether leader election is used to ensure that only one replica of the KMM Operator is running at any time. For more information, see https://kubernetes.io/docs/concepts/architecture/leases/[Leases]. The recommended value is `true`.
54+
55+
|`leaderElection.resourceID`
56+
|Determines the name of the resource that leader election uses for holding the leader lock. The recommended value is `kmm.sigs.x-k8s.io`.
57+
58+
|`webhook.disableHTTP2`
59+
|If `true`, disables HTTP/2 for the webhook server, as a mitigation for link:https://access.redhat.com/security/cve/cve-2023-44487[cve-2023-44487]. The recommended value is `true`.
60+
61+
|`webhook.port`
62+
|Defines the port on which the Operator monitors webhook requests. The recommended value is `9443`.
63+
64+
|`metrics.enableAuthnAuthz`
65+
a|Determines if metrics are authenticated using `TokenReviews` and authorized using `SubjectAccessReviews` with the kube-apiserver.
66+
67+
For authentication and authorization, the controller needs a `ClusterRole` with the following rules:
68+
69+
* `apiGroups: authentication.k8s.io, resources: tokenreviews, verbs: create`
70+
71+
* `apiGroups: authorization.k8s.io, resources: subjectaccessreviews, verbs: create`
72+
73+
To scrape metrics, for example, using Prometheus, the client needs a `ClusterRole` with the following rule:
74+
75+
* `nonResourceURLs: "/metrics", verbs: get`
76+
77+
The recommended value is `true`.
78+
79+
|`metrics.disableHTTP2`
80+
|If `true`, disables HTTP/2 for the metrics server as a mitigation for https://access.redhat.com/security/cve/cve-2023-44487[CVE-2023-44487]. The recommended value is `true`.
81+
82+
|`metrics.bindAddress`
83+
|Determines the bind address for the metrics server. If unspecified, the default is `:8080`. To disable the metrics server, set to `0`. The recommended value is `0.0.0.0:8443`.
84+
85+
|`metrics.secureServing`
86+
|Determines whether the metrics are served over HTTPS instead of HTTP. The recommended value is `true`.
87+
88+
|`worker.runAsUser`
89+
|Determines the value of the `runAsUser` field of the worker container's security context. For more information, see link:https://kubernetes.io/docs/tasks/configure-pod-container/security-context/[SecurityContext]. The recommended value is `9443`.
90+
91+
|`worker.seLinuxType`
92+
|Determines the value of the `seLinuxOptions.type` field of the worker container's security context. For more information, see link:https://kubernetes.io/docs/tasks/configure-pod-container/security-context/[SecurityContext]. The recommended value is `spc_t`.
93+
94+
|`worker.setFirmwareClassPath`
95+
|Sets the kernel's firmware search path into the `/sys/module/firmware_class/parameters/path` file on the node. The recommended value is `/var/lib/firmware` if you need to set that value through the worker app. Otherwise, unset.
96+
|===
97+
98+
. After modifying the settings, restart the controller with the following command:
99+
+
100+
[source,terminal]
101+
----
102+
$ oc delete pod -n "<namespace>" -l app.kubernetes.io/component=kmm
103+
----
104+
+
105+
[NOTE]
106+
====
107+
The value of <namespace> depends on your original installation method.
108+
====

‎modules/kmm-setting-kernel-firmware-search-path.adoc

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * hardware_enablement/kmm-kernel-module-management.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="kmm-setting-kernel-firmware-search-path_{context}"]
7+
= Setting the kernel firmware search path
8+
9+
The Linux kernel accepts the `firmware_class.path` parameter as a search path for firmware, as explained in link:https://www.kernel.org/doc/html/latest/driver-api/firmware/fw_search_path.html[Firmware search paths].
10+
11+
KMM worker pods can set this value on nodes by writing to sysfs before attempting to load kmods.
12+
13+
.Procedure
14+
15+
* To define a firmware search path, set `worker.setFirmwareClassPath` to `/var/lib/firmware` in the Operator configuration.

‎modules/kmm-unloading-kernel-module.adoc

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * hardware_enablement/kmm-kernel-module-management.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="kmm-unloading-kernel-module_{context}"]
7+
= Unloading the kernel module
8+
9+
You must unload the kernel modules when moving to a newer version or if they introduce some undesirable side effect on the node.
10+
11+
.Procedure
12+
13+
* To unload a module loaded with KMM from nodes, delete the corresponding `Module` resource. KMM then creates worker pods, where required, to run `modprobe -r` and unload the kernel module from the nodes.
14+
+
15+
[WARNING]
16+
====
17+
When unloading worker pods, KMM needs all the resources it uses when loading the kernel module. This includes the `ServiceAccount` referenced in the `Module` as well as any RBAC defined to allow privileged KMM worker Pods to run. It also includes any pull secret referenced in `.spec.imageRepoSecret`.
18+
19+
To avoid situations where KMM is unable to unload the kernel module from nodes:
20+
21+
* Do not delete those resources while the `Module` resource is still present in the cluster in any state, including `Terminating`.
22+
* Do not delete any namespace containing at least a `Module` resource.
23+
====

0 commit comments

Comments
 (0)