Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-31576

SELinux: kubelet running with wrong label [release-4.15]

XMLWordPrintable

      Description of problem:

      The kubelet is running with `unconfined_service_t`. It should run as `kubelet_exec_t`. This is causing all our plugins to fail because of Selinux denial.

sh-5.1# ps -AZ | grep kubelet
system_u:system_r:unconfined_service_t:s0 8719 ? 00:24:50 kubelet

This issue was previously observed and resolved in 4.14.10.

      Version-Release number of selected component (if applicable):

      OCP 4.15

      How reproducible:

      Run ps -AZ | grep kubelet to see kubelet running with wrong label

      Steps to Reproduce:

          1.
    2.
    3.

      Actual results:

          Kubelet is running as unconfined_service_t

      Expected results:

          Kubelet should run as kubelet_exec_t

      Additional info:

            aos-node@redhat.com Node Team Bot Account
            hersh.pathak1@intel.com Hersh Pathak
            Min Li Min Li
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: