Media pool tuning¶

Status: Current | Last reviewed: 2026-05-28

Telephony pods (asterisk, kamailio, janus, rtpengine, coturn) have requirements general-purpose nodes don't meet. Run them on a dedicated node pool with the tuning below.

Node pool¶

Aspect	Value
Label	`node-pool: media`
Taint	`media=true:NoSchedule`
Min nodes	2 (HA for kamailio + asterisk)
Instance	At least 4 vCPU / 8Gi RAM per node

Pods opt in via nodeSelector + toleration:

nodeSelector:
  node-pool: media
tolerations:
  - key: media
    operator: Equal
    value: "true"
    effect: NoSchedule

hostNetwork¶

All five media services run with hostNetwork: true. The chart already sets this; do not override.

spec:
  hostNetwork: true
  dnsPolicy: ClusterFirstWithHostNet

The Downward API injects status.hostIP so each pod knows its public address for ICE candidates and SDP rewriting.

Kernel module (rtpengine)¶

In bare-metal or full-VM nodes, install the rtpengine kernel module on the host. In-kernel forwarding raises throughput from ~200 to several thousand concurrent calls per node.

GKE/EKS managed nodes generally don't allow kernel modules; rtpengine falls back to userspace forwarding. Plan capacity accordingly.

Sysctl tuning¶

For nodes running rtpengine and/or kamailio, raise UDP buffer sizes:

net.core.rmem_max=16777216
net.core.wmem_max=16777216
net.ipv4.udp_mem=8192 16384 32768
net.ipv4.udp_rmem_min=4096
net.ipv4.udp_wmem_min=4096
net.netfilter.nf_conntrack_max=1048576

Apply via the cloud's node-tuning mechanism (GKE node-tuning DaemonSet, EKS launch template userdata, AKS daemonset).

File descriptor limits¶

Janus and rtpengine open many sockets. Raise the per-pod limit:

securityContext:
  sysctls:
    - name: net.ipv4.ip_local_port_range
      value: "10000 65535"

…and ensure the container has nofile raised to at least 65535.

Global Accelerator (AWS)¶

GA DNATs PUBLIC_IP → LAN_IP. rtpengine must bind both interfaces — see rtpengine.md. This is the single most common cause of "calls connect but no audio" on AWS.

NetworkPolicy¶

Media pods cannot use NetworkPolicy in hostNetwork: true mode (policies don't apply to host-network pods on most CNIs). Enforce isolation at the node-pool level instead — only put media pods on the media pool.