Added sysctl config to support cis-hardening

terraform/modules/k8s-cluster/manager-node.tf

@@ -104,6 +104,7 @@ resource "hcloud_server" "manager" {
     ssh_setup : base64encode(templatefile("${path.module}/templates/scripts/ssh-setup.sh", {
       admin_user : var.admin_user
     }))
+    sysctl_setup : base64encode(file("${path.module}/templates/scripts/sysctl-setup.sh"))
     microk8s_setup : base64encode(templatefile("${path.module}/templates/scripts/microk8s-setup.sh", {
       microk8s_channel : var.microk8s_channel
       main_node = count.index == 0

terraform/modules/k8s-cluster/templates/cloud-init-k8s-manager.tftpl

@@ -72,6 +72,7 @@ runcmd:
   - /usr/local/bin/install-packages.sh
   - /usr/local/bin/firewall-setup.sh
   - /usr/local/bin/ssh-setup.sh
+  - /usr/local/bin/sysctl-setup.sh
   - /usr/local/bin/microk8s-setup.sh
 %{ if main_node ~}
   - sudo /usr/local/bin/cluster-setup.sh

terraform/modules/k8s-cluster/templates/cloud-init-k8s-worker.tftpl

@@ -40,6 +40,11 @@ write_files:
     path: /run/tmpfiles.d/ssh-setup.sh
     encoding: base64
     defer: true
+  - owner: root:root
+    content: "${sysctl_setup}"
+    path: /run/tmpfiles.d/sysctl-setup.sh
+    encoding: base64
+    defer: true
   - owner: root:root
     content: "${microk8s_setup}"
     path: /run/tmpfiles.d/microk8s-setup.sh
@@ -50,5 +55,6 @@ runcmd:
   - /usr/local/bin/install-packages.sh
   - /usr/local/bin/firewall-setup.sh
   - /usr/local/bin/ssh-setup.sh
+  - /usr/local/bin/sysctl-setup.sh
   - /usr/local/bin/microk8s-setup.sh
 

terraform/modules/k8s-cluster/templates/scripts/sysctl-setup.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+printf "vm.overcommit_memory = 1\nkernel.panic = 10\nkernel.panic_on_oops = 1" > /etc/sysctl.d/90-kubelet.conf

terraform/modules/k8s-cluster/worker-node.tf

@@ -83,6 +83,7 @@ resource "hcloud_server" "worker" {
     ssh_setup : base64encode(templatefile("${path.module}/templates/scripts/ssh-setup.sh", {
       admin_user : var.admin_user
     }))
+    sysctl_setup : base64encode(file("${path.module}/templates/scripts/sysctl-setup.sh"))
     microk8s_setup : base64encode(templatefile("${path.module}/templates/scripts/microk8s-setup.sh", {
       microk8s_channel : var.microk8s_channel
       main_node : false