From 3d5dd8521d1d70d8d4aa59a5b002e4f58d875739 Mon Sep 17 00:00:00 2001
From: alix-graylog <alix.fullerton@graylog.com>
Date: Thu, 2 Jul 2026 15:56:44 -0400
Subject: [PATCH] feat(data-node): Adding sysctlInit datanode init container to
 set vm.max_map_count

---
 charts/graylog/README.md                      | 48 +++++++++++++++++++
 .../workload/statefulsets/datanode.yaml       | 14 ++++++
 charts/graylog/values.schema.json             | 20 ++++++++
 charts/graylog/values.yaml                    |  9 ++++
 4 files changed, 91 insertions(+)

diff --git a/charts/graylog/README.md b/charts/graylog/README.md
index f87a697..230b8a5 100644
--- a/charts/graylog/README.md
+++ b/charts/graylog/README.md
@@ -37,6 +37,54 @@ Official Helm chart for Graylog.
 - Helm **v3.0+**
 - MongoDB Controllers for Kubernetes Operator **v1.6.1** (required unless a [user-provided MongoDB](#bring-your-own-mongodb) is supplied)
 
+## Prerequisites
+
+### Data Node
+
+#### Kernel Parameter: vm.max_map_count
+
+The Data Node component embeds OpenSearch, which requires the kernel parameter `vm.max_map_count` to be set to at least **262144**. 
+Most cloud-managed Kubernetes clusters (EKS, GKE, AKS) default to **65530**, which will cause the Data Node to fail at startup.
+
+**Check the current value on your cluster nodes:**
+```sh
+sysctl vm.max_map_count
+```
+
+**If the value is less than 262144, you have two options:**
+
+**Option 1: Manual cluster-wide fix (recommended for existing clusters)**
+```sh
+# Run on each node (or via a DaemonSet)
+sudo sysctl -w vm.max_map_count=262144
+
+# Make it permanent
+echo "vm.max_map_count=262144" | sudo tee -a /etc/sysctl.conf
+sudo sysctl -p
+```
+
+**Option 2: Automatic fix via Helm (opt-in)**
+Enable the `sysctlInit` container when installing. This runs a privileged init container once during pod startup to set the kernel parameter.
+
+**Values file approach (recommended):**
+```yaml
+# values.yaml
+datanode:
+  sysctlInit:
+    enabled: true
+    vmMaxMapCount: 262144  # optional, defaults to 262144
+```
+
+Then install: `helm install graylog graylog/graylog -n graylog --create-namespace -f values.yaml`
+
+This runs a one-time privileged init container on each Data Node pod to adjust the kernel parameter. The container runs only during startup and does not affect the main application container.
+
+
+The default value is **262144** (the minimum required by OpenSearch). The value must be at least 262144.
+> [!NOTE]
+> This does not retroactively fix nodes that already exist in your cluster; existing nodes must be updated manually.
+
+
 ## External Dependencies
 
 This Helm chart is designed as a turnkey solution for quick demos and proofs of concept,
diff --git a/charts/graylog/templates/workload/statefulsets/datanode.yaml b/charts/graylog/templates/workload/statefulsets/datanode.yaml
index 73036d1..4fade65 100644
--- a/charts/graylog/templates/workload/statefulsets/datanode.yaml
+++ b/charts/graylog/templates/workload/statefulsets/datanode.yaml
@@ -47,6 +47,20 @@ spec:
       {{- if .Values.serviceAccount.create }}
       serviceAccountName: {{ include "graylog.serviceAccountName" . }}
       {{- end }}
+      initContainers:
+        {{- if .Values.datanode.sysctlInit.enabled }}
+        - name: sysctl-init
+          image: "{{ .Values.datanode.sysctlInit.image.repository }}:{{ .Values.datanode.sysctlInit.image.tag }}"
+          imagePullPolicy: {{ .Values.datanode.sysctlInit.image.imagePullPolicy | default "IfNotPresent" }}
+          {{- with .Values.datanode.sysctlInit.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          command:
+            - sh
+            - -c
+            - sysctl -w vm.max_map_count={{ .Values.datanode.sysctlInit.vmMaxMapCount }}
+        {{- end }}
       containers:
         - name: graylog-datanode
           image: {{ include "graylog.datanode.image" . }}
diff --git a/charts/graylog/values.schema.json b/charts/graylog/values.schema.json
index 2779b8d..3bb8d38 100644
--- a/charts/graylog/values.schema.json
+++ b/charts/graylog/values.schema.json
@@ -442,6 +442,26 @@
             "imagePullSecrets": { "type": "array" }
           }
         },
+        "sysctlInit": {
+          "type": "object",
+          "description": "Optional privileged init container to set vm.max_map_count during pod startup",
+          "properties": {
+            "enabled": { "type": "boolean" },
+            "image": {
+              "type": "object",
+              "properties": {
+                "repository": { "type": "string" },
+                "tag": { "type": "string" },
+                "imagePullPolicy": { "type": "string" }
+              }
+            },
+            "securityContext": {
+              "type": "object",
+              "description": "Container security context"
+            },
+            "vmMaxMapCount": { "type": "integer", "minimum": 262144, "description": "Kernel vm.max_map_count value for OpenSearch (minimum 262144)" }
+          }
+        },
         "updateStrategy": {
           "type": "object",
           "properties": {
diff --git a/charts/graylog/values.yaml b/charts/graylog/values.yaml
index 958eb5a..cb0d49c 100644
--- a/charts/graylog/values.yaml
+++ b/charts/graylog/values.yaml
@@ -210,6 +210,15 @@ datanode:
     tag: ""
     imagePullPolicy: IfNotPresent
     imagePullSecrets: []
+  sysctlInit:
+    enabled: false
+    image:
+      repository: "busybox"
+      tag: "1.35"
+      imagePullPolicy: IfNotPresent
+    securityContext:
+      privileged: true
+    vmMaxMapCount: 262144
   updateStrategy:
     type: RollingUpdate
     rollingUpdate: