AKS support sysctls via az nodepool add via --kubelet-config

Unfortunately, you won't be able to use az nodepool update to set this configuration. This is only available when you create a nodepool and you get a chance to specify kubelet-config which allows you to enable "unsafe" options such as net.ipv4.tcp_keepalive_time.

For example, let's say you have the following configuration kubelet.config

{ "cpuManagerPolicy": "static", "cpuCfsQuota": true, "cpuCfsQuotaPeriod": "200ms", "imageGcHighThreshold": 90, "imageGcLowThreshold": 70, "topologyManagerPolicy": "best-effort", "allowedUnsafeSysctls": [ "kernel.msg*", "net.*" ], "failSwapOn": false }

To roll this out, simply execute the following:

az aks nodepool add --name testpool --cluster-name mydev-aks-cluster --resource-group mydevaks-unsafe --kubelet-config ./testkubelet.config

Then execute nodepool show to display your settings:

az aks nodepool show --cluster-name mydev-aks-cluster --name testpool --resource-group mydevaks-unsafe