What container sysctl calls are used? (GKE Autopilot Helm deploy fails)

[jeremiahlee]

I am trying to deploy the Mastodon Helm chart onto a GKE Autopilot cluster. It is failing due to container sysctl calls somewhere getting blocked because GKE does not allow them.

I get this error repeated 4 times:

* admission webhook "warden-validating.common-webhooks.networking.gke.io" denied the request: GKE Warden rejected the request because it violates one or more constraints.
Violations details: {"[denied by autogke-disallow-privilege]":["container sysctl is privileged; not allowed in Autopilot"]}

The mastodon-sidekiq-all-queues, mastodon-streaming, mastodon-web workloads/deployments specifically are failing. (The mastodon-media-remove cron job deployed fine.)

What systctl calls are made by Mastodon? Is there a way for them to not be made?

[jeremiahlee]

Thanks to @emilweth, the issue is with the Elasticsearch Bitnami chart, a dependency in the official Mastodon Helm chart. It requires sysctl initContainer. The options are to not use Elasticsearch (it's an optional dependency) or to use a managed Elasticsearch from a cloud provider.

Unfortunately, when all 3 Bitnami dependencies are disabled (for example, when using managed versions from a cloud provider), there is a blocking error related to common.names.fullname that has been fixed but not merged. mastodon/chart#60