- Pods were allowed to use the `net.ipv4.tcp_rmem` and `net.ipv4.tcp_wmem` sysctl by default
  when the kernel version was 4.15 or higher. With the kernel 4.15 the sysctl became namespaced.

    # Add vagrant to the Docker group, so that it can run commands
    usermod -aG docker vagrant

    # Enable IPv4 forwarding
    sed -i '/net.ipv4.ip_forward/s/^#//' /etc/sysctl.conf
    systemctl restart networking
  SHELL
end


def deb_docker(config)
  config.vm.provision 'install Docker using apt', type: 'shell', inline: <<-SHELL

  
  When the feature gate is enabled, kubelet ignores errors that happens during setting the following sysctl values: `vm.overcommit_memory`, `vm.panic_on_oom`, `kernel.panic`, `kernel.panic_on_oops`, `kernel.keys.root_maxkeys`, `kernel.keys.root_maxbytes`. (These sysctl values for the host, not for the containers)
  
  kubelet also ignores an error during opening `/dev/kmsg`.

- Kubelet allows pods to use the `net.ipv4.ip_local_reserved_ports` sysctl by default and the minimal kernel version is 3.16; Pod Security admission allows this sysctl in v1.27+ versions of the baseline and restricted policies. ([#115374](https://github.com/kubernetes/kubernetes/pull/115374), [@pacoxu](https://github.com/pacoxu)) [SIG Auth, Network and Node]

pkg syscall (darwin-386-cgo), const ICMP6_FILTER ideal-int
pkg syscall (darwin-386-cgo), const ImplementsGetwd = true
pkg syscall (darwin-386-cgo), const PRIO_PGRP = 1
pkg syscall (darwin-386-cgo), const PRIO_PGRP ideal-int
pkg syscall (darwin-386-cgo), const PRIO_PROCESS = 0
pkg syscall (darwin-386-cgo), const PRIO_PROCESS ideal-int
pkg syscall (darwin-386-cgo), const PRIO_USER = 2
pkg syscall (darwin-386-cgo), const PRIO_USER ideal-int

* Fix how we iterate over active jobs when removing them for Replace policy ([#36161](https://github.com/kubernetes/kubernetes/pull/36161), [@soltysh](https://github.com/soltysh))
* Adds TCPCloseWaitTimeout option to kube-proxy for sysctl nf_conntrack_tcp_timeout_time_wait ([#35919](https://github.com/kubernetes/kubernetes/pull/35919), [@bowei](https://github.com/bowei))

## Urgent Upgrade Notes 

### (No, really, you MUST read this before you upgrade)

pkg syscall (netbsd-arm64-cgo), const AF_DATAKIT ideal-int
pkg syscall (netbsd-arm64-cgo), const AF_DECnet = 12
pkg syscall (netbsd-arm64-cgo), const AF_DECnet ideal-int
pkg syscall (netbsd-arm64-cgo), const AF_DLI = 13
pkg syscall (netbsd-arm64-cgo), const AF_DLI ideal-int
pkg syscall (netbsd-arm64-cgo), const AF_E164 = 26
pkg syscall (netbsd-arm64-cgo), const AF_E164 ideal-int
pkg syscall (netbsd-arm64-cgo), const AF_ECMA = 8

pkg syscall (freebsd-arm64), const B50 = 50
pkg syscall (freebsd-arm64), const B50 ideal-int
pkg syscall (freebsd-arm64), const B57600 = 57600
pkg syscall (freebsd-arm64), const B57600 ideal-int
pkg syscall (freebsd-arm64), const B600 = 600
pkg syscall (freebsd-arm64), const B600 ideal-int
pkg syscall (freebsd-arm64), const B7200 = 7200
pkg syscall (freebsd-arm64), const B7200 ideal-int

- Pod SecurityContext and PodSecurityPolicy supports slash as sysctl separator. ([#106834](https://github.com/kubernetes/kubernetes/pull/106834), [@mengjiao-liu](https://github.com/mengjiao-liu)) [SIG Apps, Architecture, Auth, Node, Security and Testing]