Ingress-nginx could use k8s native sysctl

[jakolehm]

https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#setting-sysctls-for-a-pod

[SpComb]

Seems like net.ipv4.ip_local_port_range is considered a safe sysctl and allowed by default, but tuning net.core.somaxconn would require kubelet --allowed-unsafe-sysctls net.core.somaxconn.

The default net.core.somaxconn = 128 could cause slowdowns with very high rates of new connections (faster than nginx is able to accept them), but TCP should handle retries in that case (assuming default net.ipv4.tcp_abort_on_overflow=0): https://serverfault.com/questions/518862/will-increasing-net-core-somaxconn-make-a-difference

[SpComb]

...except that the ingress-nginx pod runs with hostNetwork: true, so those sysctls affect the entire node.