Aside: Applying Kernel Tunnables quickly (randomize_va_space)

When a Tuned profile changes a sysctl such as:

[sysctl]
kernel.randomize_va_space=0

You can use TuneD Custom Resource:

apiVersion: tuned.openshift.io/v1
kind: Tuned
metadata:
  name: disable-aslr
  namespace: openshift-cluster-node-tuning-operator
spec:
  profile:
  - name: disable-aslr-profile
    data: |
      [main]
      summary=Disable ASLR
      include=openshift-node

      [sysctl]
      kernel.randomize_va_space=0

  recommend:
  - priority: 20
    profile: disable-aslr-profile
    match:
    - label: node-role.kubernetes.io/worker

The Node Tuning Operator/tuned applies it dynamically via the sysctl interface, so a reboot is typically not required. The new value takes effect immediately on the node after the profile is applied.

You can verify:

oc debug node/<node>
chroot /host

sysctl kernel.randomize_va_space

or

cat /proc/sys/kernel/randomize_va_space

Disabling ASLR through a Tuned object, the setting is applied without a node reboot. You can usually observe the change within seconds after the profile becomes active.