Uploaded image for project: 'OpenShift Storage'
  1. OpenShift Storage
  2. STOR-1078

Update CSI drivers operators in OCP to support mount with SELinux


    • Icon: Story Story
    • Resolution: Done
    • Icon: Undefined Undefined
    • None
    • None
    • None
    • Storage Sprint 230

      As OCP developer (and as OCP user in the future), I want all CSI drivers shipped as part of OCP to support mounting with -o context=XYZ, so I can test with CSIDriver.SELinuxMount: true (or my pods are running without CRI-O recursively relabeling my volume).


      In detail:

      • For CSI drivers based on block devices, pass host's /etc/selinux and /sys/fs/ to the CSI drvier container on the node as HostPath volumes
      • For CSI drivers based on NFS / CIFS: do the same as for block volumes (it won't harm the driver in any way), but investigate if these drivers can actually run with CSIDriver.SELinuxMount: true.

      Details: https://github.com/kubernetes/enhancements/tree/master/keps/sig-storage/1710-selinux-relabeling#selinux-support-in-volumes


      Exit criteria:

      • Verify that CSI drivers shipped by OCP based on block volumes mount volumes with -o context=xyz instead of relabeling the volumes by CRI-O. That should happen when all these conditions are satisfied:
        • SELinuxMountReadWriteOncePod and ReadWriteOncePod feature gates are enabled
        • CSIDriver.SELinuxMount is set to true manually for the CSI driver. OCP will not do it by default in 4.13, because it requires the alpha feature gates from the previous bullet.
        • PVC has AccessMode: [ReadWriteOncePod] 
        • Pod has SELinux context explicitly assigned, i.e. pod.spec.securityContext (or pod.spec.containers[*].securityContext) has seLinuxOptions set, incl. {{level }}(based on SCC, OCP might do it automatically)
      • This is alpha / dev preview feature, so QE might done when graduating to Beta / tech preview.

            rhn-engineering-jsafrane Jan Safranek
            rhn-engineering-jsafrane Jan Safranek
            0 Vote for this issue
            1 Start watching this issue