OSDOCS 16932 CQA 2.0 of NODES-4: Container/Pod Runtime Configuration II by mburke5678 · Pull Request #107102 · openshift/openshift-docs

mburke5678 · 2026-02-23T21:05:51Z

https://issues.redhat.com/browse/OSDOCS-16932

Previews:
Using port forwarding to access applications in a container
Executing remote commands in an OpenShift Container Platform container
Using sysctls in containers
Understanding Containers

openshift-ci-robot · 2026-02-23T21:05:54Z

@mburke5678: No Jira issue with key NODES-4 exists in the tracker at https://issues.redhat.com/.
Once a valid jira issue is referenced in the title of this pull request, request a refresh with /jira refresh.

Details

In response to this:

https://issues.redhat.com/browse/OSDOCS-16932

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

ocpdocs-previewbot · 2026-02-23T21:13:57Z

🤖 Tue Mar 03 19:35:32 - Prow CI generated the docs preview:
https://107102--ocpdocs-pr.netlify.app
Complete list of updated preview URLs: artifacts/updated_preview_urls.txt

openshift-ci-robot · 2026-03-02T18:40:24Z

@mburke5678: No Jira issue with key NODES-4 exists in the tracker at https://issues.redhat.com/.
Once a valid jira issue is referenced in the title of this pull request, request a refresh with /jira refresh.

Details

In response to this:

https://issues.redhat.com/browse/OSDOCS-16932

Previews:
Using port forwarding to access applications in a container
Executing remote commands in an OpenShift Container Platform container
Using sysctls in containers
Understanding Containers

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

skopacz1

Left some comments, otherwise good to merge once feedback is addressed!

modules/nodes-containers-port-forwarding-about.adoc

modules/nodes-containers-port-forwarding-protocol.adoc

modules/nodes-containers-start-pod-safe-sysctls.adoc

modules/nodes-containers-sysctls-about.adoc

skopacz1 · 2026-03-03T17:26:56Z

modules/nodes-containers-sysctls-unsafe.adoc

+where:
+
+`spec.machineConfigPoolSelector.matchLabels`:: Specifies the label from the machine config pool.
+`spec.kubeletConfig.allowedUnsafeSysctls`:: Specifies a list of unsafe sysctls to allow.


Just an FYI that the YAML file above still has the callout labels themselves, those need to be removed as well

I am guaranteed to neglect to remove them at least once a PR so far....

skopacz1 · 2026-03-03T17:31:32Z

modules/nodes-safe-sysctls-list.adoc


 | `net.ipv4.ping_group_range`
-a| This restricts `ICMP_PROTO` datagram sockets to users in the group range. The default is `1 0`, meaning that nobody, not even root, can create ping sockets. For more information, see link:https://docs.kernel.org/networking/ip-sysctl.html?highlight=ping_group_range#ip-variables[ping_group_range].
+a| Restricts `ICMP_PROTO` datagram sockets to users in the group range. The default is `1 0`, meaning that nobody, not even root, can create ping sockets. For more information, see link:https://docs.kernel.org/networking/ip-sysctl.html?highlight=ping_group_range#ip-variables[ping_group_range].


Up to you if you want to clean this all up, but technically this table has a bunch of external links that would need a parentheses telling users where the link needs:

Suggested change

a| Restricts `ICMP_PROTO` datagram sockets to users in the group range. The default is `1 0`, meaning that nobody, not even root, can create ping sockets. For more information, see link:https://docs.kernel.org/networking/ip-sysctl.html?highlight=ping_group_range#ip-variables[ping_group_range].

a| Restricts `ICMP_PROTO` datagram sockets to users in the group range. The default is `1 0`, meaning that nobody, not even root, can create ping sockets. For more information, see link:https://docs.kernel.org/networking/ip-sysctl.html?highlight=ping_group_range#ip-variables[ping_group_range] (kernel documentation).

Good idea!

But, needs to go inside the [link text (kernel documentation)], right?

modules/update-network-sysctl-allowlist.adoc

openshift-ci · 2026-03-03T19:36:44Z

@mburke5678: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

mburke5678 · 2026-03-03T20:03:40Z

/cherrypick enterprise-4.16

mburke5678 · 2026-03-03T20:03:45Z

/cherrypick enterprise-4.17

mburke5678 · 2026-03-03T20:03:48Z

/cherrypick enterprise-4.18

mburke5678 · 2026-03-03T20:03:51Z

/cherrypick enterprise-4.19

mburke5678 · 2026-03-03T20:03:55Z

/cherrypick enterprise-4.20

mburke5678 · 2026-03-03T20:03:59Z

/cherrypick enterprise-4.21

mburke5678 · 2026-03-03T20:04:03Z

/cherrypick enterprise-4.22

openshift-cherrypick-robot · 2026-03-03T20:04:27Z

@mburke5678: #107102 failed to apply on top of branch "enterprise-4.16":

Applying: OSDOCS 16932 CQA 2.0 of NODES-4: Container/Pod Runtime Configuration II
.git/rebase-apply/patch:138: trailing whitespace.
For example, use the following command to listen on a free port locally and forward to `5000` in the pod: 
.git/rebase-apply/patch:507: trailing whitespace.
Some sysctls are _namespaced_ in the Linux kernels. This means that you can set them independently for each pod on a node. 
warning: 2 lines add whitespace errors.
Using index info to reconstruct a base tree...
M	nodes/containers/nodes-containers-remote-commands.adoc
M	nodes/containers/nodes-containers-sysctls.adoc
M	nodes/containers/nodes-containers-using.adoc
Falling back to patching base and 3-way merge...
Auto-merging nodes/containers/nodes-containers-using.adoc
CONFLICT (content): Merge conflict in nodes/containers/nodes-containers-using.adoc
Auto-merging nodes/containers/nodes-containers-sysctls.adoc
CONFLICT (content): Merge conflict in nodes/containers/nodes-containers-sysctls.adoc
Auto-merging nodes/containers/nodes-containers-remote-commands.adoc
CONFLICT (content): Merge conflict in nodes/containers/nodes-containers-remote-commands.adoc
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 OSDOCS 16932 CQA 2.0 of NODES-4: Container/Pod Runtime Configuration II

Details

In response to this:

/cherrypick enterprise-4.16

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-cherrypick-robot · 2026-03-03T20:04:32Z

@mburke5678: #107102 failed to apply on top of branch "enterprise-4.17":

Applying: OSDOCS 16932 CQA 2.0 of NODES-4: Container/Pod Runtime Configuration II
.git/rebase-apply/patch:138: trailing whitespace.
For example, use the following command to listen on a free port locally and forward to `5000` in the pod: 
.git/rebase-apply/patch:507: trailing whitespace.
Some sysctls are _namespaced_ in the Linux kernels. This means that you can set them independently for each pod on a node. 
warning: 2 lines add whitespace errors.
Using index info to reconstruct a base tree...
M	nodes/containers/nodes-containers-remote-commands.adoc
M	nodes/containers/nodes-containers-using.adoc
Falling back to patching base and 3-way merge...
Auto-merging nodes/containers/nodes-containers-using.adoc
Auto-merging nodes/containers/nodes-containers-remote-commands.adoc
CONFLICT (content): Merge conflict in nodes/containers/nodes-containers-remote-commands.adoc
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 OSDOCS 16932 CQA 2.0 of NODES-4: Container/Pod Runtime Configuration II

Details

In response to this:

/cherrypick enterprise-4.17

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-cherrypick-robot · 2026-03-03T20:04:36Z

@mburke5678: #107102 failed to apply on top of branch "enterprise-4.18":

Applying: OSDOCS 16932 CQA 2.0 of NODES-4: Container/Pod Runtime Configuration II
.git/rebase-apply/patch:138: trailing whitespace.
For example, use the following command to listen on a free port locally and forward to `5000` in the pod: 
.git/rebase-apply/patch:507: trailing whitespace.
Some sysctls are _namespaced_ in the Linux kernels. This means that you can set them independently for each pod on a node. 
warning: 2 lines add whitespace errors.
Using index info to reconstruct a base tree...
M	nodes/containers/nodes-containers-remote-commands.adoc
Falling back to patching base and 3-way merge...
Auto-merging nodes/containers/nodes-containers-remote-commands.adoc
CONFLICT (content): Merge conflict in nodes/containers/nodes-containers-remote-commands.adoc
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 OSDOCS 16932 CQA 2.0 of NODES-4: Container/Pod Runtime Configuration II

Details

In response to this:

/cherrypick enterprise-4.18

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-cherrypick-robot · 2026-03-03T20:04:45Z

@mburke5678: new pull request created: #107841

Details

In response to this:

/cherrypick enterprise-4.19

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-cherrypick-robot · 2026-03-03T20:04:49Z

@mburke5678: new pull request created: #107842

Details

In response to this:

/cherrypick enterprise-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-cherrypick-robot · 2026-03-03T20:04:53Z

@mburke5678: new pull request created: #107843

Details

In response to this:

/cherrypick enterprise-4.21

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-cherrypick-robot · 2026-03-03T20:04:59Z

@mburke5678: new pull request created: #107844

Details

In response to this:

/cherrypick enterprise-4.22

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

mburke5678 added this to the Continuous Release milestone Feb 23, 2026

mburke5678 added branch/enterprise-4.16 branch/enterprise-4.17 branch/enterprise-4.18 branch/enterprise-4.19 branch/enterprise-4.20 branch/enterprise-4.21 labels Feb 23, 2026

mburke5678 added the branch/enterprise-4.22 label Feb 23, 2026

openshift-ci bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Feb 23, 2026

openshift-ci bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Mar 2, 2026

openshift deleted a comment from ocpdocs-vale-bot Mar 2, 2026

mburke5678 force-pushed the cqa-2-nodes-container-pod-2 branch from 14f805c to 77641c0 Compare March 2, 2026 18:37

mburke5678 added the merge-review-needed Signifies that the merge review team needs to review this PR label Mar 2, 2026

openshift deleted a comment from ocpdocs-vale-bot Mar 2, 2026

mburke5678 force-pushed the cqa-2-nodes-container-pod-2 branch from 77641c0 to 190001c Compare March 2, 2026 18:44

openshift deleted a comment from ocpdocs-vale-bot Mar 2, 2026

skopacz1 added the merge-review-in-progress Signifies that the merge review team is reviewing this PR label Mar 3, 2026

skopacz1 reviewed Mar 3, 2026

View reviewed changes

skopacz1 added ok-to-merge and removed merge-review-in-progress Signifies that the merge review team is reviewing this PR merge-review-needed Signifies that the merge review team needs to review this PR labels Mar 3, 2026

mburke5678 force-pushed the cqa-2-nodes-container-pod-2 branch from 190001c to 442bb07 Compare March 3, 2026 19:12

OSDOCS 16932 CQA 2.0 of NODES-4: Container/Pod Runtime Configuration II

345be44

mburke5678 force-pushed the cqa-2-nodes-container-pod-2 branch from 442bb07 to 345be44 Compare March 3, 2026 19:23

mburke5678 merged commit d7bfca0 into openshift:main Mar 3, 2026
2 checks passed

mburke5678 deleted the cqa-2-nodes-container-pod-2 branch March 3, 2026 20:02

openshift-cherrypick-robot mentioned this pull request Mar 3, 2026

[enterprise-4.19] OSDOCS 16932 CQA 2.0 of NODES-4: Container/Pod Runtime Configuration II #107841

Merged

openshift-cherrypick-robot mentioned this pull request Mar 3, 2026

[enterprise-4.20] OSDOCS 16932 CQA 2.0 of NODES-4: Container/Pod Runtime Configuration II #107842

Merged

openshift-cherrypick-robot mentioned this pull request Mar 3, 2026

[enterprise-4.21] OSDOCS 16932 CQA 2.0 of NODES-4: Container/Pod Runtime Configuration II #107843

Merged

openshift-cherrypick-robot mentioned this pull request Mar 3, 2026

[enterprise-4.22] OSDOCS 16932 CQA 2.0 of NODES-4: Container/Pod Runtime Configuration II #107844

Open

	a\| Restricts `ICMP_PROTO` datagram sockets to users in the group range. The default is `1 0`, meaning that nobody, not even root, can create ping sockets. For more information, see link:https://docs.kernel.org/networking/ip-sysctl.html?highlight=ping_group_range#ip-variables[ping_group_range].
	a\| Restricts `ICMP_PROTO` datagram sockets to users in the group range. The default is `1 0`, meaning that nobody, not even root, can create ping sockets. For more information, see link:https://docs.kernel.org/networking/ip-sysctl.html?highlight=ping_group_range#ip-variables[ping_group_range] (kernel documentation).

Conversation

mburke5678 commented Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Feb 23, 2026

Uh oh!

ocpdocs-previewbot commented Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Mar 2, 2026

Uh oh!

skopacz1 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

skopacz1 Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

mburke5678 Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

skopacz1 Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

mburke5678 Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

openshift-ci bot commented Mar 3, 2026

Uh oh!

Uh oh!

mburke5678 commented Mar 3, 2026

Uh oh!

mburke5678 commented Mar 3, 2026

Uh oh!

mburke5678 commented Mar 3, 2026

Uh oh!

mburke5678 commented Mar 3, 2026

Uh oh!

mburke5678 commented Mar 3, 2026

Uh oh!

mburke5678 commented Mar 3, 2026

Uh oh!

mburke5678 commented Mar 3, 2026

Uh oh!

openshift-cherrypick-robot commented Mar 3, 2026

Uh oh!

openshift-cherrypick-robot commented Mar 3, 2026

Uh oh!

openshift-cherrypick-robot commented Mar 3, 2026

Uh oh!

openshift-cherrypick-robot commented Mar 3, 2026

Uh oh!

openshift-cherrypick-robot commented Mar 3, 2026

Uh oh!

openshift-cherrypick-robot commented Mar 3, 2026

Uh oh!

openshift-cherrypick-robot commented Mar 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

mburke5678 commented Feb 23, 2026 •

edited

Loading

ocpdocs-previewbot commented Feb 23, 2026 •

edited

Loading

mburke5678 Mar 3, 2026 •

edited

Loading

mburke5678 Mar 3, 2026 •

edited

Loading