From 2798853153f313090c4e780dae032f1c329aada1 Mon Sep 17 00:00:00 2001
From: Ruakij <ruakij@ruekov.eu>
Date: Fri, 9 Oct 2026 12:55:46 +0000
Subject: [PATCH] Raise the inotify limits of the k3s nodes to 65536 instances
 and 4194304 watches, except in LXC

---
 kubernetes/tasks/node.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/kubernetes/tasks/node.yml b/kubernetes/tasks/node.yml
index 5fe84fa..eb9b5e8 100644
--- a/kubernetes/tasks/node.yml
+++ b/kubernetes/tasks/node.yml
@@ -34,3 +34,16 @@
         regexp: '^\s*- config-dir='
         line: '  - config-dir=/etc/rancher/k3s/kubelet.conf.d'
         insertafter: '^kubelet-arg:'
+
+# Every pod watching its config files takes inotify instances and watches from
+# the per-user pool. An LXC container inherits these from its host. Only this
+# file is loaded: sysctl --system would also apply distribution defaults such as
+# rp_filter that differ from the live values Cilium relies on.
+- name: Raise the inotify limits
+  tags: inotify
+  when: ansible_facts['virtualization_type'] != 'lxc'
+  ansible.posix.sysctl:
+    name: "{{ item.key }}"
+    value: "{{ item.value }}"
+    sysctl_file: /etc/sysctl.d/90-inotify.conf
+  loop: "{{ {'fs.inotify.max_user_instances': 65536, 'fs.inotify.max_user_watches': 4194304} | dict2items }}"