diff --git a/pkg/volume/csi/csi_attacher.go b/pkg/volume/csi/csi_attacher.go index 57fbcb7e9c5..cf6b108251b 100644 --- a/pkg/volume/csi/csi_attacher.go +++ b/pkg/volume/csi/csi_attacher.go @@ -377,7 +377,7 @@ func (c *csiAttacher) MountDevice(spec *volume.Spec, devicePath string, deviceMo if err != nil { return errors.New(log("failed to query for SELinuxMount support: %s", err)) } - if support { + if support && deviceMounterArgs.SELinuxLabel != "" { mountOptions = util.AddSELinuxMountOption(mountOptions, deviceMounterArgs.SELinuxLabel) } } diff --git a/pkg/volume/csi/csi_mounter.go b/pkg/volume/csi/csi_mounter.go index 89c110c0add..b811754dffb 100644 --- a/pkg/volume/csi/csi_mounter.go +++ b/pkg/volume/csi/csi_mounter.go @@ -259,7 +259,7 @@ func (c *csiMountMgr) SetUpAt(dir string, mounterArgs volume.MounterArgs) error if err != nil { return errors.New(log("failed to query for SELinuxMount support: %s", err)) } - if support { + if support && mounterArgs.SELinuxLabel != "" { mountOptions = util.AddSELinuxMountOption(mountOptions, mounterArgs.SELinuxLabel) selinuxLabelMount = true } diff --git a/pkg/volume/csi/csi_mounter_test.go b/pkg/volume/csi/csi_mounter_test.go index 1254c5b68ee..fbbca1d8281 100644 --- a/pkg/volume/csi/csi_mounter_test.go +++ b/pkg/volume/csi/csi_mounter_test.go @@ -200,6 +200,15 @@ func TestMounterSetUp(t *testing.T) { enableSELinuxFeatureGate: true, expectedVolumeContext: nil, }, + { + name: "should not include selinux mount options, if feature gate is enabled, driver supports it, but Pod does not have it", + driver: "supports_selinux", + seLinuxLabel: "", + expectedSELinuxContext: "", // especially make sure the volume plugin does not use -o context="", that is an invalid value + volumeContext: nil, + enableSELinuxFeatureGate: true, + expectedVolumeContext: nil, + }, } noPodMountInfo := false