tuned rp_filter parameters fail to persist on Worker Nodes in TCA

Products

• VMware Telco Cloud Automation
• VMware Telco Cloud Platform

Issue/Introduction

• When attempting to disable the Reverse Path Filtering (rp_filter) kernel parameters on a Workload cluster, the settings fail to persist on the worker nodes.
  
  
• Configuring net.ipv4.conf.all.rp_filter=0 via a custom tuned profile initially applies, but the parameter reverts to 1 shortly after deployment, despite successful configuration injection attempts by TCA
  
  
• Executing the  sysctl -a | grep net.ipv4.conf.all.rp_filter  command on the affected worker node confirms the reverted state
  
  
• tuned daemon logs validate this discrepancy and show a failure state during the health check:
  
  ERROR tuned.plugins.base: verify: failed: 'net.ipv4.conf.all.rp_filter' = '1', expected '0'

Environment

VMware Telco Cloud Automation (TCA) 3.2
TCP 5.0

Cause

The root cause is tied to the reapply_sysctl parameter behavior located in the worker node's global configuration file (/etc/tuned/tuned-main.conf). Although tuned successfully writes and applies rp_filter=0 via the /etc/tuned/loadmodule/tuned.conf profile, the underlying operating system's default behaviour overwrites these custom settings shortly after they are applied. when tuned performs its verification check (tuned-adm verify), it detects the OS-level value of 1 instead of the configured 0

Resolution

• To ensure the rp_filter setting remains persistent, user must explicitly set reapply_sysctl = 0 to prevent the operating system from overriding custom tuned profiles with system defaults
  
  
• Automating this via the CSAR file (Network Function Descriptor) guarantees that the configuration is applied immediately and consistently during node customization, eliminating the need for manual intervention
  
  
• After re-instantiating the updated Network Function package, validate parameter persistence by executing the following command on the worker nodes sysctl -a | grep rp_filter 

Implementation Steps:

Utilize the file_injection method within Network Function Descriptor (NFD) YAML to push the appropriate configuration files to their strict respective paths on the worker nodes:

1. Update the Global Configuration Inject a tuned-main.conf file that explicitly sets reapply_sysctl = 0.
    Target Path: /etc/tuned/tuned-main.conf

2. Update the Profile Configuration Inject custom TuneD profile containing the required [sysctl] parameters (e.g., net.ipv4.conf.all.rp_filter=0).
    Target Path: /etc/tuned/loadmodule/tuned.conf

Note: Ensure the tuned-main.conf artifact only contains valid key=value pairs and no un-commented plain text, as this will cause the tuned parser to fail.

Additional Information

Example NFD.yaml file_injection block

file_injection:
            # 1. Global Configuration
            - source: file
              content: ../Artifacts/scripts/tuned-main.conf
              path: /etc/tuned/tuned-main.conf
              
            # 2. Profile Configuration
            - source: file
              content: ../Artifacts/scripts/tuned-config.yaml
              path: /etc/tuned/loadmodule/tuned.conf

Reference: https://techdocs.broadcom.com/us/en/vmware-sde/telco-cloud/vmware-telco-cloud-automation/3-2/vmware-telco-cloud-automation-user-guide/managing-network-function-catalogs/customizing-network-functions/node-customization/tosca-node-components.html