Kubelet_pod_pids_limit and LimitMEMLOCK in kubelet configuration for production cluster

General Discussions microk8s
, ,
1

We are finalizing security configurations for our production Kubernetes cluster and would appreciate your review of the following proposed kubelet settings:

Proposed Configuration

  1. PID Limits
  • pod_pids_limit: -1 (Unlimited) for all nodes
  1. Memory Locking (mlock) Limits
  • Worker & Control Plane Nodes: LimitMEMLOCK=512M
  • etcd Nodes: LimitMEMLOCK=1G
  1. Does this align with production security best practices?
  2. Are there any risks with pod_pids_limit=-1 we should mitigate?