github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2026-07-18 04:54:54 +00:00
Code Issues Projects Releases Wiki Activity

Fix policy of Pods with unknown SELinux label

Browse Source 
Reset SELinuxChangePolicy of Pods that have no SELinux label set to
Recursive. Kubelet cannot mount with `-o context=<label>`, if the label is
not known.

This fixes the e2e test error revealed by the previous commit - it changed the
e2e test to check for events when no events are expected and it found a
warning about a Pod with no label, but MountOption policy.
This commit is contained in:
Jan Safranek
2025-12-08 12:36:59 +01:00
parent 4999d9a9e4
commit cfa65ceed2
2 changed files with 31 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
pkg/controller/volume/selinuxwarning/selinux_warning_controller.go
View File

@@ -511,8 +511,15 @@ func (c *Controller) syncVolume(logger klog.Logger, pod *v1.Pod, spec *volume.Sp
changePolicy := v1.SELinuxChangePolicyMountOption
if pod.Spec.SecurityContext != nil && pod.Spec.SecurityContext.SELinuxChangePolicy != nil {
changePolicy = *pod.Spec.SecurityContext.SELinuxChangePolicy
logger.V(5).Info("Using Pod SELinux change policy", "pod", klog.KObj(pod), "changePolicy", changePolicy)
}
if !pluginSupportsSELinuxContextMount {
if !pluginSupportsSELinuxContextMount && changePolicy != v1.SELinuxChangePolicyRecursive {
logger.V(5).Info("Volume does not support SELinux context mount, setting changePolicy to Recursive", "pod", klog.KObj(pod), "volume", spec.Name())
changePolicy = v1.SELinuxChangePolicyRecursive
}
if seLinuxLabel == "" && changePolicy != v1.SELinuxChangePolicyRecursive {
logger.V(5).Info("Pod has empty SELinux label, setting changePolicy to Recursive", "pod", klog.KObj(pod))
changePolicy = v1.SELinuxChangePolicyRecursive
}

23
pkg/controller/volume/selinuxwarning/selinux_warning_controller_test.go
View File

@@ -340,6 +340,29 @@ func TestSELinuxWarningController_Sync(t *testing.T) {
`Normal SELinuxLabelConflict SELinuxLabel ":::s0:c1,c2" conflicts with pod pod2 that uses the same volume as this pod with SELinuxLabel ":::s0:c98,c99". If both pods land on the same node, only one of them may access the volume.`,
},
},
{
name: "empty label implies Recursive policy",
existingPVCs: []*v1.PersistentVolumeClaim{
pvcBoundToPV("pv1", "pvc1"),
},
existingPVs: []*v1.PersistentVolume{
pvBoundToPVC("pv1", "pvc1"),
},
existingPods: []*v1.Pod{
pod("pod1", "", ptr.To(v1.SELinuxChangePolicyMountOption)).withPVC("pvc1", "vol1").build(),
},
pod: cache.ObjectName{Namespace: namespace, Name: "pod1"},
conflicts: []volumecache.Conflict{},
expectedAddedVolumes: []addedVolume{
{
volumeName: "fake-plugin/pv1",
podKey: cache.ObjectName{Namespace: namespace, Name: "pod1"},
label: "",
changePolicy: v1.SELinuxChangePolicyRecursive, // Reset to Recursive when the label is empty
csiDriver: "ebs.csi.aws.com",
},
},
},
{
name: "pending pod is processed",
existingPVCs: []*v1.PersistentVolumeClaim{