The goal is to collect metrics about SELinux usage among pods because we need to know how many pods would be affected if we enabled a feature to all volume types.

• cluster:kube_selinux_pod_context_mismatch_total is the sum of volume_manager_selinux_pod_context_mismatch_warnings_total and volume_manager_selinux_pod_context_mismatch_errors_total. It represents pods with two or more containers that have each different SELinux context and thus can't use the same volume. One value per cluster.
• cluster:kube_selinux_volume_context_mismatch_errors_total represents the number of pods that uses a (ReadWriteOncePod) volume that is already mounted with a different SELinux context.
• cluster:kube_selinux_volume_context_mismatch_warnings_total is the same as cluster:kube_selinux_volume_context_mismatch_errors_total, but only for non ReadWriteOncePod volumes.
• cluster:kube_selinux_volumes_admitted_total represent the number of pods that have SELinux labels set and their volume plugin/driver supports SELinux and thus the "mount -o context" would be used when mounting volumes.

Note: I'm not sure these will be the final names.

Labels

• volume_plugin: each CSI driver and in-tree volume plugin that supports SELinux are possible values.

We expect the cardinality for each metric to be low, 1-2 on a newly installed cluster (nr. of volume plugins + CSI drivers that support SELinux mount). Cardinality will grow by one for each 3rd party CSI driver installed. The upper limit of cardinality is the same as this existing metrics (not all volume plugins support SELinux and thus the actual nr. of labels will be lower).