Selinux Mount Option #2253
Selinux Mount Option #2253
Conversation
k8s-ci-robot
added
do-not-merge/work-in-progress
k8s-ci-robot
added
the
cncf-cla: yes
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
size/S
Code Coverage DiffThis PR does not change the code coverage |
|
flake (kops failed to create cluster) /retest |
|
/retest lots of flakes today |
ConnorJC3
force-pushed
the
selinux-mounts
branch
from
2acf2f6 to
32f6bda
Compare
k8s-ci-robot
removed
the
do-not-merge/work-in-progress
Signed-off-by: Connor Catlett <conncatl@amazon.com>
ConnorJC3
force-pushed
the
selinux-mounts
branch
from
32f6bda to
2eefc58
Compare
|
/retest |
k8s-ci-robot
added
the
lgtm
| @@ -342,6 +342,9 @@ controller: | |||
| # Enable dnsConfig for the controller and node pods | |||
| dnsConfig: {} | |||
| node: | |||
| # Enable SELinux-only optimizations on the EBS CSI Driver node pods | |||
| # Must only be set true if all linux nodes in the DaemonSet have SELinux enabled | |||
There was a problem hiding this comment.
Non-blocking comment: Do we want to recommend additional daemonsets feature in-line here.
An extra sentence like: "Please rely on additional daemonsets feature if this is not the case."
What type of PR is this?
/kind feature
What is this PR about? / Why do we need it?
Adds a new helm parameter,
node.selinux, that mounts the relevant directories to allow the selinux-awaremountbinary to perform selinux-specific optimizations. (This parameter can also be used in the future for any other selinux optimizations on the node).This must be a parameter that is default-disabled, because
/sys/fs/selinuxwill not exist unless SELinux is actually enabled on the nodes.How was this change tested?
CI/Manually
Does this PR introduce a user-facing change?