Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding SELinux Documentation #900

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

cniackz
Copy link
Contributor

@cniackz cniackz commented Apr 13, 2024

Objective:

When resuming or suspending a drive in an OpenShift cluster, we may encounter a relabel issue. Various solutions exist for this problem, but here I am documenting the one we believe to be the best approach.

@cniackz cniackz self-assigned this Apr 13, 2024
@cniackz cniackz added the documentation Improvements or additions to documentation label Apr 13, 2024
@cniackz cniackz requested a review from ravindk89 April 13, 2024 18:58
@cniackz
Copy link
Contributor Author

cniackz commented Apr 13, 2024

NET:[VulnCheck / Analysis (pull_request) ] fix is on #901

docs/volume-management.md Outdated Show resolved Hide resolved
docs/volume-management.md Outdated Show resolved Hide resolved
@Praveenrajmani
Copy link
Collaborator

PTAL @cniackz

@cniackz cniackz force-pushed the selinux-documentation-apr13 branch from 95448ad to 62e070b Compare July 26, 2024 14:09
Copy link
Contributor

@ravindk89 ravindk89 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Open Question - should we make this a pre-requisite for OpenShift clusters running SELinux?

If you encounter the `relabel failed` error after executing the `suspend` or `resume` commands, you should set `spc_t` at the Tenant level Specification, as demonstrated below:

```yaml
kind: Tenant
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  1. This is more specific to MinIO Operator, but DirectPV is meant for any container require local storage access. We would need to add documentation to generic use case as primary and extend it to MinIO server and MinIO Operator.
  2. Does pod level setting Pod.Spec.SecurityContext.SELinuxOptions.Type = spc_t work?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@cniackz ^^ PTAL

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
documentation Improvements or additions to documentation
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants