-
Notifications
You must be signed in to change notification settings - Fork 82
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Adding SELinux Documentation #900
base: master
Are you sure you want to change the base?
Conversation
NET:[VulnCheck / Analysis (pull_request) ] fix is on #901 |
pools: | ||
- containerSecurityContext: | ||
seLinuxOptions: | ||
type: spc_t |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is there a consequence to setting this at initial setup? E.g. should the operator simply do this in general?
@@ -172,3 +172,18 @@ Suspended volumes can be resumed once they are fixed. Upon resuming, the corresp | |||
```sh | |||
> kubectl directpv resume volumes --nodes node-1 --drives dm-3 | |||
``` | |||
|
|||
## SELinux in OpenShift: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This section should be in https://github.com/minio/directpv/blob/master/docs/openshift.md
|
||
## SELinux in OpenShift: | ||
|
||
If you encounter the `relabel failed` error after executing the `suspend` or `resume` commands, you should set `spc_t` at the Tenant level Specification, as demonstrated below: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
- Do we have version information of openshift like > v4.12?
- Pods using suspended drives/volumes fail due to kubelet try to do selinux relabeling because of
lsetxattr
syscall fails on read-only filesystem. This issue would occur on any pod consuming suspended volume not limiting to MinIO Tenant pods. We would need to cover this information as well.
PTAL @cniackz |
Objective:
When
resuming
orsuspending
a drive in anOpenShift
cluster, we may encounter arelabel
issue. Various solutions exist for this problem, but here I am documenting the one we believe to be the best approach.