BLOG08: What is the Linux Module

BLOG17: Linux Modules and Runtime Tunables Required by Kubernetes

During Kubernetes installation, especially on Linux nodes (Ubuntu, CentOS, etc.), we typically enable some kernel modules and sysctl parameters so the container runtime and Kubernetes networking work correctly.

This document provides a clear explanation of why OverlayFS, br_netfilter, and sysctl net forwarding parameters are enabled.

---

1. overlay Kernel Module

Purpose: Enables OverlayFS — a modern union filesystem used by container runtimes.

Why it is needed?

• Docker, containerd, CRI-O use overlay2 storage driver.

• Without it, containers cannot layer images efficiently.

• It provides copy-on-write → fast container startup + small disk usage.

Check

lsmod | grep overlay

Enable permanently

cat <<EOF | sudo tee /etc/modules-load.d/containerd.conf
overlay
EOF
sudo modprobe overlay

---

2. br_netfilter Kernel Module

Purpose: Ensures Linux bridge interfaces (used by CNI plugins like Calico, Flannel, Cilium) pass network traffic through iptables.

Why it is needed?

Containers use a Linux bridge (cni0, flannel.1, docker0) for pod-to-pod networking.

If br_netfilter is NOT enabled:

• kube-proxy rules won’t work

• Pod networking fails

• NAT (masquerading) breaks

Check

lsmod | grep br_netfilter

Enable permanently

cat <<EOF | sudo tee /etc/modules-load.d/k8s.conf
br_netfilter
EOF
sudo modprobe br_netfilter

---

3. Sysctl Parameters (net.bridge.*, net.ipv4.ip_forward)

These ensure that Linux forwards traffic and handles bridged traffic properly.

Config 1: Allow iptables to inspect bridged traffic

net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1

Why?

• kube-proxy programs iptables rules for service routing.

• These settings ensure traffic passing through CNI bridges is visible to iptables.

---

Config 2: Enable IP forwarding

net.ipv4.ip_forward = 1

Why?

• Required for pod-to-pod routing across nodes.

• Kubernetes assumes the OS kernel will forward packets just like a router.

• If disabled → pods cannot reach external networks or other nodes.

---

Apply sysctl settings permanently

cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward = 1
EOF

sudo sysctl --system

---

Summary: Why We Enable These

Component	Reason	Required For
overlay	Container filesystem layering	containerd, Docker, CRI-O
br_netfilter	Allow iptables to inspect bridged packets	kube-proxy, CNI plugins
net.bridge.*	Ensure CNI bridge traffic hits iptables	Networking
net.ipv4.ip_forward	Allow routing between pods/nodes	Pod networking, Services

These settings ensure:

• Container runtime operates normally

• Pod networking works

• kube-proxy iptables rules take effect

• Node can route traffic between pods and external world

---

What is the difference between modprobe and sysctl parameters in Linux (especially for Kubernetes)?

This section explains the clear and simple difference between modprobe and sysctl parameters in Linux — especially in the context of Kubernetes.

---

modprobe vs sysctl — Key Difference

Feature	modprobe	sysctl
What it controls	Kernel modules (drivers/features)	Kernel runtime parameters (tunable settings)
Purpose	Load/Unload kernel module into the kernel	Modify kernel behavior without changing code
Examples in Kubernetes	overlay, br_netfilter	ip_forward, bridge-nf-call-iptables
When applied	When a module is needed by the OS or apps	Applied at runtime for network behavior
File locations	/lib/modules/$(uname -r)/	/proc/sys/ and /etc/sysctl.conf
Persistence method	/etc/modules-load.d/*.conf	/etc/sysctl.d/*.conf

---

1. What is modprobe?

modprobe = load a kernel module (plugin) into the running Linux kernel.

Think of kernel modules as drivers or features the kernel can turn on/off.

Example modules:

• overlay → for container filesystem

• br_netfilter → bridge packet filtering

• ip_tables → iptables backend

Load module

sudo modprobe overlay

Check module loaded

lsmod | grep overlay

Persist it

echo overlay | sudo tee /etc/modules-load.d/containerd.conf

Important: If a module is not loaded, sysctl parameters depending on it will not work.

---

2. What is sysctl?

sysctl = configure kernel runtime parameters under /proc/sys/*.

These parameters modify:

• Networking

• Routing

• Memory behaviour

• File system limits

Example sysctl values:

net.ipv4.ip_forward = 1
net.bridge.bridge-nf-call-iptables = 1

Apply immediately

sudo sysctl -w net.ipv4.ip_forward=1

Persist it

echo "net.ipv4.ip_forward = 1" | sudo tee /etc/sysctl.d/k8s.conf

---

How Kubernetes Uses Each

modprobe (Kernel Modules):

Module	Why Kubernetes needs it
overlay	Needed for containerd storage driver
br_netfilter	So iptables can filter bridged pod traffic

If these are missing → container runtime or networking will fail.

---

sysctl (Kernel Parameters):

Parameter	Why Kubernetes needs it
net.ipv4.ip_forward=1	Allow node to route pod traffic
net.bridge.bridge-nf-call-iptables=1	Allow iptables to inspect pod traffic
vm.max_map_count	Required by Elasticsearch, etc.

---

Simple Analogy

• modprobe = install/load a kernel feature

• sysctl = configure how the kernel behaves

Example:

• modprobe br_netfilter loads the feature.

• sysctl net.bridge.bridge-nf-call-iptables=1 configures how that feature works.

---

Final Summary

modprobe

• Loads kernel modules (drivers/features)

• One-time action per boot unless made persistent

• Required before using related sysctl values

sysctl

• Adjusts kernel parameters

• Controls kernel behavior

• Must be persisted via /etc/sysctl.d/

This section provides a clean, accurate, and production-ready comparison of the sysctl + kernel module requirements across Kubeadm, RKE2, K3s, and MicroK8s — highlighting what is needed, why, and what each installer does automatically vs manually.

---

1. Kubeadm — Manual & Full Control (Most Requirements)

You must enable all kernel modules + sysctl values yourself.

Required Kernel Modules

Module	Why
overlay	Required by containerd/Docker overlay2 driver
br_netfilter	Needed for iptables to inspect CNI bridge traffic

Required Sysctl Parameters

net.bridge.bridge-nf-call-iptables=1
net.bridge.bridge-nf-call-ip6tables=1
net.ipv4.ip_forward=1

Additional (Optional for DNS, big clusters)

fs.inotify.max_user_watches=524288
fs.inotify.max_user_instances=512

Who sets them?

• kubeadm does not set them

• containerd does not set them

• You must set them manually or via Ansible

---

2. RKE2 — Mostly Automatic (Best for Production)

RKE2 is a hardened Kubernetes distribution from Rancher/SUSE.

RKE2 automatically loads most modules and sets most sysctl parameters.

Kernel Modules (Auto-loaded by RKE2)

Module	Auto?	Reason
overlay	Yes	containerd
br_netfilter	Yes	CNI (Canal/Calico default)
ip_tables, nf_nat, xt_conntrack	Yes	kube-proxy

Sysctl Parameters (Auto-set by RKE2)

Parameter	Auto?	Reason
net.ipv4.ip_forward=1	Yes	Required for routing
net.bridge.bridge-nf-call-iptables=1	No (depends on distro)	Usually needed
vm.max_map_count=262144	Yes	Required for Elasticsearch/Rancher workloads

Notes

• RKE2 ships with its own hardened kernel security profile.

• Networking uses Cilium, Canal, or Calico, and automatically ensures needed modules.

---

3. K3s — Lightweight & Automatic (Most Settings Auto)

K3s is a lightweight Kubernetes distribution by Rancher.

K3s automatically configures almost everything for you.

Kernel Modules

Module	Auto?
overlay	Yes (Auto-loaded)
br_netfilter	Yes (Auto-loaded)

Sysctl

Sysctl	Auto?
net.ipv4.ip_forward=1	Yes
net.bridge.bridge-nf-call-iptables	Depends on host OS — often must be set manually on Ubuntu server

Additional

K3s bundles:

• containerd

• flannel or cilium CNI

• traefik ingress

It includes its own optimized networking stack, so it requires fewer manual settings.

---

4. MicroK8s — Everything Auto + Snap Sandboxed Config

MicroK8s (Canonical) is the most automatic of all.

MicroK8s automatically configures almost all sysctl and modules.

Kernel Modules

Module	Auto?
overlay	Yes
br_netfilter	Yes
nf_conntrack / ip_tables	Yes

Sysctl Parameters

Parameter	Auto?
net.ipv4.ip_forward=1	Yes
net.bridge.bridge-nf-call-iptables=1	Ubuntu already default on Desktop, may need to set manually on Server
fs.inotify*	Auto-adjusted

Special Note

MicroK8s runs inside snap confinement, so it bundles:

• containerd

• CNI (Flannel or Calico)

• kubeproxy

• dns

• registry

• ingress

It manages sysctl values per namespace using snap hooks.

---

Final Summary Table

Feature / Requirement	Kubeadm	RKE2	K3s	MicroK8s
overlay module	Manual	Auto	Auto	Auto
br_netfilter module	Manual	Auto	Auto	Auto
ip_forward	Manual	Auto	Auto	Auto
bridge-nf-call-iptables	Manual	Sometimes auto	Maybe manual on some OS	Depends on host
inotify limits	Manual	Partly auto	Maybe	Maybe
container runtime	user installs	built-in containerd	built-in containerd	built-in containerd
CNI	user installs	bundled	bundled	bundled
Best for	Production clusters	Hardened production	Edge/IoT/Dev	Developer/Small prod

---

TL;DR — If you use kubeadm: you must configure everything manually.

• Kubeadm = DIY Kubernetes → you set sysctl + modules

• RKE2 = Hardened Kubernetes → most done for you

• K3s = Lightweight → most done for you

• MicroK8s = One command → almost everything auto