Kubelet_pod_pids_limit and LimitMEMLOCK in kubelet configuration for production cluster

Anusha_Ruwanpathiran
Wed, 07 May 2025 14:21:45 +0000
microk8s

We are finalizing security configurations for our production Kubernetes cluster and would appreciate your review of the following proposed kubelet settings:

Proposed Configuration

1. PID Limits

pod_pids_limit: -1 (Unlimited) for all nodes

2. Memory Locking (mlock) Limits

Worker & Control Plane Nodes: LimitMEMLOCK=512M

etcd Nodes: LimitMEMLOCK=1G

1. Does this align with production security best practices?

2. Are there any risks with pod_pids_limit=-1 we should mitigate?

1 post - 1 participant