GKE node with modprobe

Question

Is there a way to load any kernel module ("modprobe nfsd" in my case) automatically after starting/upgrading nodes or in GKE? We are running an NFS server pod on our kubernetes cluster and it dies after every GKE upgrade

Tried both cos and ubuntu images, none of them seems to have nfsd loaded by default.

Also tried something like this, but it seems it does not do what it is supposed to do:

kind: DaemonSet
apiVersion: extensions/v1beta1
metadata:
  name: nfsd-modprobe
  labels:
    app: nfsd-modprobe
spec:
  template:
    metadata:
      labels:
        app: nfsd-modprobe
    spec:
      hostPID: true
      containers:
        - name: nfsd-modprobe
          image: gcr.io/google-containers/startup-script:v1
          imagePullPolicy: Always
          securityContext:
            privileged: true
          env:
          - name: STARTUP_SCRIPT
            value: |
              #! /bin/bash

              modprobe nfs
              modprobe nfsd
              while true; do sleep 1; done

Answer 1

I faced the same issue, existing answer is correct, I want to expand it with working example of nfs pod within kubernetes cluster which has capabilities and libraries to load required modules.

It has two important parts:

• privileged mode
• mounted /lib/modules directory within the container to use it

nfs-server.yaml

kind: Pod
apiVersion: v1
metadata:
  name: nfs-server-pod
spec:
  containers:
    - name: nfs-server-container
      image: erichough/nfs-server
      securityContext:
        privileged: true
      env:
      - name: NFS_EXPORT_0
        value: "/test *(rw,no_subtree_check,insecure,fsid=0)"
      volumeMounts:
      - mountPath: /lib/modules # mounting modules into container
        name: lib-modules
        readOnly: true # make sure it's readonly
      - mountPath: /test
        name: export-dir
  volumes:
  - hostPath: # using hostpath to get modules from the host
      path: /lib/modules
      type: Directory
    name: lib-modules
  - name: export-dir
    emptyDir: {}

Reference which helped as well - Automatically load required kernel modules.

Answer 2

By default, you cannot load modules from inside a container because excluding kernel components is one of the main reason containers are lightweight and portable. You need to load the module from the host OS in order to make it available inside the container. This means you could simply launch a script that enables the kernel modules you want after each GKE upgrade.

However, there exists a somewhat hacky way to load kernel modules from inside a docker container. It all boils down to launching your container with escalated privileges and with access to certain host directories. You should try that if you really want to mount your kernel modules while inside a container.