docs(machine-config): kubelet & firewall configuration guides + disruption/chrony fixes

[chinameok]

Summary

Adds day-2 node-configuration guides to the Machine Configuration section:

• Configuring Kubelet (new): manage kubelet settings via a --config-dir drop-in with MachineConfig. Covers enabling the config directory, changing settings, the settings you can change (with recommended ranges), platform-managed settings to avoid, and when changes take effect.
• Managing Firewall Ports (new): open additional host ports via a firewalld policy file (nftables backend prerequisite included).
• Node Disruption Policies: explicit warning that file changes default to None and need a disruption policy to take effect.
• Managing Node Configuration (chrony): add the node disruption policy required to restart chronyd.

Lints clean (yarn lint: 0 errors).

Notes for reviewers

• The Enabling the Kubelet Configuration Directory section assumes nodes do not ship with --config-dir enabled by default. If the platform enables it by default, that section can be dropped to simplify the guide.
• To be backported to release-1.0.

Summary by CodeRabbit

• Documentation
  • Added a firewall configuration guide for managing open/close of ports via declarative policies, including backend-specific prerequisites and an end-to-end example.
  • Added a kubelet configuration guide covering drop-in configuration, a two-phase enablement workflow, and safety notes about whole unit management and restart behavior.
  • Expanded guidance on node disruption policies, including explicit warnings that file changes won’t restart services by default and that restart-only behavior (e.g., chronyd) must use the correct policy action.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 17b04ba6-4e56-48da-a758-d6a5117b9edc

📥 Commits

Reviewing files that changed from the base of the PR and between c32e47f and 8beb89e.

📒 Files selected for processing (1)

• docs/en/machine-configuration/kubelet_config.mdx

✅ Files skipped from review due to trivial changes (1)

• docs/en/machine-configuration/kubelet_config.mdx

---

Walkthrough

Four documentation changes are added to the machine-configuration section: a new firewall.mdx guide for managing firewall ports via firewalld policies and MachineConfig, a new kubelet_config.mdx guide for kubelet drop-in configuration, a nodeDisruptionPolicy example appended to the chrony section in managing.mdx, and a warning callout added to node_disruption.mdx about the default None file-change action.

Changes

MachineConfig Configuration Guides

Layer / File(s)	Summary
Node disruption default behavior warning docs/en/machine-configuration/node_disruption.mdx	Inserts a warning admonition stating that the default None file-change action writes files to disk without restarting services, and instructs users to define and verify a node disruption policy in status.nodeDisruptionPolicyStatus before applying a MachineConfig.
Chrony node disruption policy example docs/en/machine-configuration/managing.mdx	Appends a MachineConfiguration manifest example showing a nodeDisruptionPolicy that applies DaemonReload and Restart for /etc/chrony.conf changes, with a note to use Restart (not Reload) and confirm nodeDisruptionPolicyStatus.
Firewall port management guide docs/en/machine-configuration/firewall.mdx	New page covering the nftables prerequisite check, creating and base64-encoding an XML firewalld policy to open a TCP port, deploying it via MachineConfig, wiring a nodeDisruptionPolicy to reload firewalld, and closing the port by deleting the MachineConfig.
Kubelet drop-in directory setup docs/en/machine-configuration/kubelet_config.mdx (lines 1–84)	New page introduction explaining the two-phase configuration workflow, and the one-time setup section: enabling the kubelet --config-dir drop-in directory via a systemd drop-in file written by MachineConfig, paired with a nodeDisruptionPolicy to DaemonReload and restart kubelet.service without rebooting or evicting pods.
Kubelet day-to-day settings and reference docs/en/machine-configuration/kubelet_config.mdx (lines 86–171)	Describes applying KubeletConfiguration snippets to the drop-in directory via MachineConfig with a node disruption policy, provides a reference table of configurable fields with a warning about invalid values, lists platform-managed settings that must not be changed, and describes per-setting timing semantics for when changes take effect after restart.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐇 Hop, hop, the configs align,
Firewall ports now open just fine.
Kubelet drops in, chrony restarts,
Node disruption warnings—good starts!
No reboot needed, the rabbit's at ease,
Docs done right, the cluster's a breeze. 🌟

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main changes: kubelet and firewall configuration guides are the two primary additions, and disruption/chrony fixes represent the secondary documentation updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/machine-config-day2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cloudflare-workers-and-pages]

Deploying alauda-immutable-infra with    Cloudflare Pages

Latest commit:	8beb89e
Status:	✅  Deploy successful!
Preview URL:	https://73ee4f30.alauda-immutable-infra.pages.dev
Branch Preview URL:	https://docs-machine-config-day2.alauda-immutable-infra.pages.dev

View logs