github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-29 06:27:05 +00:00
Code Issues Projects Releases Wiki Activity

Report error on a pod startup on SELinux mismatch

Browse Source 
When a volume is already mounted with an unexpected SELinux label,
kubelet must unmount it first and then mount it back with the expected one.
Report an error to user, just in case the unmount takes too long.

In therory, this error should not happen too often, because two Pods with
different SELinux label will not enter Desired State of World, see
dsw.AddPodToVolume. It can happen when DSW and ASW SELinux labels only when
a volume has been deleted from DSW (= Pod was deleted) or a volume was
reconstructed after kubelet restart. In both cases, volume manager should
unmount the volume quickly.
This commit is contained in:
Jan Safranek 2022-10-31 13:57:18 +01:00
parent a910d83070
commit d37808faae
2 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/kubelet/volumemanager/cache/actual_state_of_world.go vendored
View File

@ -1185,7 +1185,7 @@ type seLinuxMountMismatchError struct {
func (err seLinuxMountMismatchError) Error() string { func (err seLinuxMountMismatchError) Error() string {
return fmt.Sprintf( return fmt.Sprintf(
"volumeName %q is already mounted to a different pod with a different SELinux label", "waiting for unmount of volume %q, because it is already mounted to a different pod with a different SELinux label",
err.volumeName) err.volumeName)
} }

1
pkg/kubelet/volumemanager/reconciler/reconciler.go
View File

@ -223,6 +223,7 @@ func (rc *reconciler) mountOrAttachVolumes() {
// The volume is mounted, but with an unexpected SELinux context. // The volume is mounted, but with an unexpected SELinux context.
// It will get unmounted in unmountVolumes / unmountDetachDevices and // It will get unmounted in unmountVolumes / unmountDetachDevices and
// then removed from actualStateOfWorld. // then removed from actualStateOfWorld.
rc.desiredStateOfWorld.AddErrorToPod(volumeToMount.PodName, err.Error())
continue continue
} else if cache.IsVolumeNotAttachedError(err) { } else if cache.IsVolumeNotAttachedError(err) {
rc.waitForVolumeAttach(volumeToMount) rc.waitForVolumeAttach(volumeToMount)