Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-6968

OCP 4.12 cluster nodes having kubelet service running with unconfined_service_t

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • Undefined
    • None
    • 4.12.0
    • Compliance Operator
    • -
    • False
    • Hide

      None

      Show
      None
    • Hide
      The selinux_confinement_of_daemons rule failed running on the kubelet because of the permissions necessary for the kubelet to run.

      This rule is used in RHCOS profiles and is being temporarily disabled because of the permissions required by the kubelet to run properly.
      Show
      The selinux_confinement_of_daemons rule failed running on the kubelet because of the permissions necessary for the kubelet to run. This rule is used in RHCOS profiles and is being temporarily disabled because of the permissions required by the kubelet to run properly.
    • Bug Fix

    Description

      Description of problem:

      In OCP 4.12 cluster, kubelet service is running with unconfined_service_t instead of container_runtime

      Version-Release number of selected component (if applicable):

      $ kubelet --version
      Kubernetes v1.25.2+5497c42

      How reproducible:

      After running command "sudo ps -eZ | grep "unconfined_service_t"" on both master and worker nodes in OCP 4.12 cluster

      Steps to Reproduce:

      1. oc debug node/<nodename>
      2. sudo ps -eZ | grep "unconfined_service_t"
      

      Actual results:

      $ sudo ps -eZ | grep "unconfined_service_t"
      system_u:system_r:unconfined_service_t:s0 1412919 ? 00:57:57 kubelet

      Expected results:

      $ sudo ps -eZ | grep "unconfined_service_t"
      system_u:system_r:container_runtime_t:s0 1412919 ? 00:57:57 kubelet

      Additional info:

       

      Attachments

        Activity

          People

            jhrozek@redhat.com Jakub Hrozek
            aditijadhav38 aditi jadhav (Inactive)
            Xiaojie Yuan Xiaojie Yuan
            Votes:
            0 Vote for this issue
            Watchers:
            8 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: