sysctl: error setting key 'vm.max_map_count': Read-only file system

[sp1d3rino]

When I try to start elasticsearch-kibana only kibana pod is running and elasticsearch goes in Init Crash Loop Back-off.

I read the pod logs
kubectl logs elasticsearch-7fc6f9b9bb-8ffgg --all-containers=true
and this is the content
sysctl: error setting key 'vm.max_map_count': Read-only file system Error from server (BadRequest): container "elasticsearch" in pod "elasticsearch-7fc6f9b9bb-8ffgg" is waiting to start: PodInitializing
Any idea?
thx

[marinakog]

looks like elastic search related, did you try to resolve following this solution: spujadas/elk-docker#99

[hzhao-github]

Hi sp1d3rino,

Can you please try to add the block below to your elk yaml file?

   spec:
  initContainers:
  - name: set-vm-max-map-count
    image: busybox
    imagePullPolicy: IfNotPresent
    command: ['sysctl', '-w', 'vm.max_map_count=262144']
    securityContext:
      privileged: true
  containers:
  - name: "elasticsearch"
  .....

[rjeberhard]

@hzhao-github, I believe that @sp1d3rino needs to make these changes on the host machines. This initContainer will make the change in that container and then exit without persisting the changes to host machine configuration.

[hzhao-github]

@rjeberhard sure, based on @sp1d3rino needs, either way should work

[sp1d3rino]

@hzhao-github the code block is already present in the elk yaml.

[hzhao-github]

@sp1d3rino and it still not working?

[hzhao-github]

Have you tried the solution Marina found, spujadas/elk-docker#99?

[sp1d3rino]

@hzhao-github yes I just tried also to set vm.max_map_count=262144 on the hosting OS but it doen't work yet. I think the problem is the "read only file system"..

[hzhao-github]

@sp1d3rino I didn't do it on machine, but from the config in the container, "command: ['sysctl', '-w', 'vm.max_map_count=262144']", try giving a write permission when setting it

[sp1d3rino]

@hzhao-github how to give write permission?
I needed to change this

securityContext:
          privileged: true

setting to false because I get this
Error creating: pods "elasticsearch-6f4d6b7b4c-" is forbidden: unable to validate against any security context constraint: [spec.initContainers[0].securityContext.privileged: Invalid value: true: Privileged containers are not allowed]

[hzhao-github]

@sp1d3rino do you need to make changes on the host machines or in the container?

[sp1d3rino]

@hzhao-github In the container. but as I notice at the beginning of this thread this seems not possible due to read only file system error...

[sp1d3rino]

I solved.

1. from the host I ran
   sudo sysctl -w vm.max_map_count=262144

2. from the elk yaml I removed this line
   decommand: ['sysctl', '-w', 'vm.max_map_count=262144']
   and I put privileged: false

deleted the elasticsearch deployment and applied one more time.