mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-07-23 19:56:01 +00:00
Report error on a pod startup on SELinux mismatch
When a volume is already mounted with an unexpected SELinux label, kubelet must unmount it first and then mount it back with the expected one. Report an error to user, just in case the unmount takes too long. In therory, this error should not happen too often, because two Pods with different SELinux label will not enter Desired State of World, see dsw.AddPodToVolume. It can happen when DSW and ASW SELinux labels only when a volume has been deleted from DSW (= Pod was deleted) or a volume was reconstructed after kubelet restart. In both cases, volume manager should unmount the volume quickly.
This commit is contained in:
parent
a910d83070
commit
d37808faae
@ -1185,7 +1185,7 @@ type seLinuxMountMismatchError struct {
|
|||||||
|
|
||||||
func (err seLinuxMountMismatchError) Error() string {
|
func (err seLinuxMountMismatchError) Error() string {
|
||||||
return fmt.Sprintf(
|
return fmt.Sprintf(
|
||||||
"volumeName %q is already mounted to a different pod with a different SELinux label",
|
"waiting for unmount of volume %q, because it is already mounted to a different pod with a different SELinux label",
|
||||||
err.volumeName)
|
err.volumeName)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -223,6 +223,7 @@ func (rc *reconciler) mountOrAttachVolumes() {
|
|||||||
// The volume is mounted, but with an unexpected SELinux context.
|
// The volume is mounted, but with an unexpected SELinux context.
|
||||||
// It will get unmounted in unmountVolumes / unmountDetachDevices and
|
// It will get unmounted in unmountVolumes / unmountDetachDevices and
|
||||||
// then removed from actualStateOfWorld.
|
// then removed from actualStateOfWorld.
|
||||||
|
rc.desiredStateOfWorld.AddErrorToPod(volumeToMount.PodName, err.Error())
|
||||||
continue
|
continue
|
||||||
} else if cache.IsVolumeNotAttachedError(err) {
|
} else if cache.IsVolumeNotAttachedError(err) {
|
||||||
rc.waitForVolumeAttach(volumeToMount)
|
rc.waitForVolumeAttach(volumeToMount)
|
||||||
|
Loading…
Reference in New Issue
Block a user