How to blacklist a kernel module in OpenShift 4.x

Environment

• Red Hat OpenShift Container Platform
  • 4.x

Issue

• I need to blacklist a module in OpenShift
• I need to create a modprobe configuration file

Resolution

In OpenShift 4.x, a MachineConfig [1] can be utilized to create a modprobe configuration allowing control of the module on applicable nodes.

This can be done in two ways: using a Butane config [2] or manually.

Creating a MachineConfig with Butane will entail adding the necessary metadata, filename, and file content. Below is an example, featuring a modprobe configuration for blacklisting a module named "examplemod", with annotations for emphasis:

variant: openshift
version: 4.11.0  #   <=== OpenShift version
metadata:
  name: 99-worker-custom  # <=== name of the MachineConfig
  labels:
    machineconfiguration.openshift.io/role: worker  #  <=== labels to match
storage:
  files:
    - path: /etc/modprobe.d/blacklist_example.conf  #  <=== filename
      mode: 0644
      overwrite: true
      contents:  # File contents below
        inline: |
          blacklist examplemod

Calling Butane on this file will create the desired MachineConfig.

For the alternative method, creating the MachineConfig manually, we will first use base64 to encode the desired file content:

$ echo 'blacklist examplemod' | base64
YmxhY2tsaXN0IGV4YW1wbGVtb2QK

We can then insert this encoding into a MachineConfig like below:

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  labels:
    machineconfiguration.openshift.io/role: worker  #  <=== labels to match
  name: 99-worker-custom  # <=== name of the MachineConfig
spec:
  config:
    ignition:
      version: 3.2.0
    storage:
      files:
        - contents:
            compression: ""
            source: data:text/plain;charset=utf-8;base64,YmxhY2tsaXN0IGV4YW1wbGVtb2QK  # <== base64 encoded file contents
          mode: 420
          overwrite: true
          path: /etc/modprobe.d/blacklist_example.conf

Applying the MachineConfig created by either of these methods will result in a file "/etc/modprobe.d/blacklist_example.conf" with the contents "blacklist examplemod" on the applicable nodes.

References
[1] Using machine config objects to configure nodes
[2] Creating machine configs with Butane

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.