github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-28 05:57:25 +00:00
Code Issues Projects Releases Wiki Activity

change unconfined_t to spc_t

Browse Source 
The kube etcd and discovery pods are set to unconfined_t in
order to avoid disabling selinux, but the correct type for
an unconfined container is spc_t. For more information, see
http://danwalsh.livejournal.com/2016/10/03/.
This commit is contained in:
Jason Brooks 2016-11-22 16:25:31 -08:00
parent d49f0dbf07
commit bf153fc1d3
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
cmd/kubeadm/app/master/discovery.go
View File

@ -88,7 +88,7 @@ func newKubeDiscoveryPodSpec(cfg *kubeadmapi.MasterConfiguration) api.PodSpec {
// SELinux. This is not optimal and would be nice to adjust in future // SELinux. This is not optimal and would be nice to adjust in future
// so it can read /tmp/secret, but for now this avoids recommending // so it can read /tmp/secret, but for now this avoids recommending
// setenforce 0 system-wide. // setenforce 0 system-wide.
Type: "unconfined_t", Type: "spc_t",
}, },
}, },
}}, }},

2
cmd/kubeadm/app/master/manifests.go
View File

@ -101,7 +101,7 @@ func WriteStaticPodManifests(cfg *kubeadmapi.MasterConfiguration) error {
// SELinux. This is not optimal and would be nice to adjust in future // SELinux. This is not optimal and would be nice to adjust in future
// so it can create and write /var/lib/etcd, but for now this avoids // so it can create and write /var/lib/etcd, but for now this avoids
// recommending setenforce 0 system-wide. // recommending setenforce 0 system-wide.
Type: "unconfined_t", Type: "spc_t",
}, },
}, },
}, certsVolume(cfg), etcdVolume(cfg), k8sVolume(cfg)) }, certsVolume(cfg), etcdVolume(cfg), k8sVolume(cfg))