net.bridge.bridge-nf-call-iptables=1

net.bridge.bridge-nf-call-ip6tables =1

net.ipv4.ip_forward=1

net.ipv4.tcp_tw_recycle=0

net.ipv4.neigh.default.gc_thresh1=1024

net.ipv4.neigh.default.gc_thresh2=2048

net.ipv4.neigh.default.gc_thresh3=4096

vm.swappiness=0

vm.overcommit_memory=1

vm.panic_on_oom=0

fs.inotify.max_user_instances=8192

fs.inotify.max_user_watches=1048576

fs.file-max=52706963

fs.nr_open=52706963

net.ipv6.conf.all.disable_ipv6=1

net.netfilter.nf_conntrack_max=2310720


注：

tcp_tw_recycle 和 Kubernetes 的 NAT 冲突，必须关闭 ，否则会导致服务不通；

关闭不使用的 IPV6 协议栈，防止触发 docker BUG。