feat(csidriver): declare seLinuxMount support #598

cjorge-graphops · 2024-11-01T13:14:15Z

Pull Request template

Please, go through these steps before you submit a PR.

Why is this PR required? What issue does it fix?:

Allows zfs-localpv to support efficient SELinux relabeling (https://kubernetes.io/blog/2023/04/18/kubernetes-1-27-efficient-selinux-relabeling-beta/)

What this PR does?:

Adds seLinuxMount: true to the CSIDriver spec, by default.

Does this PR require any upgrade changes?:

No

If the changes in this PR are manually verified, list down the scenarios covered::

I've validated that when all the required conditions are met, kubelet passes an additional mount option for selinux context, which is supported by ZFS with no issues, effectively avoiding the relabeling step on preparing the PVC.

Any additional information for your reviewer? :

Related to #577

Checklist:

Fixes Support mounting with SeLinux mount options #577
PR Title follows the convention of <type>(<scope>): <subject>
Has the change log section been updated?
Commit has unit tests
Commit has integration tests
(Optional) Are upgrade changes included in this PR? If not, mention the issue/PR to track:
(Optional) If documentation changes are required, which issue on https://github.com/openebs/website is used to track them:

Signed-off-by: Carlos Jorge <[email protected]>

Abhinandan-Purkait · 2024-11-04T06:11:56Z

deploy/helm/charts/templates/csidriver.yaml

  attachRequired: false
  podInfoOnMount: false
  storageCapacity: {{ .Values.feature.storageCapacity }}
+  seLinuxMount: true


Maybe set this via helm variable?

moreover if this is supported in Kubernetes version ≥ 1.27 then why are we setting it to true as default

It seems to be accepted from 1.25.x, so I suggest this:

Suggested change

seLinuxMount: true

{{- if semverCompare ">= 1.25.x" .Capabilities.KubeVersion.Version }}

seLinuxMount: true

{{- end }}

Abhinandan-Purkait · 2024-11-04T06:12:21Z

design/enable-selinux-mount.md

+---
+title: SELinux Mount Support for LocalPV-ZFS
+authors:
+  - "@cjorge-graphops"
+creation-date: 2024-11-01
+last-updated: 2024-11-01
+---


@tiagolobocastro Should this be here?

You mean vs the root openebs? Seems we already have pv-migration here in this repo as well.
So basically, going forward do we want to keep designs per repo or on umbrella repo? CC @avishnu

Let's just keep it here for now.
Let's discuss on the next maintainers call on how to organize these better.

codecov-commenter · 2024-11-04T10:32:59Z

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 95.99%. Comparing base (e3d55d7) to head (36620f7).
Report is 13 commits behind head on develop.

❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #598      +/-   ##
===========================================
- Coverage    96.37%   95.99%   -0.38%     
===========================================
  Files            1        1              
  Lines          496      574      +78     
===========================================
+ Hits           478      551      +73     
- Misses          14       19       +5     
  Partials         4        4

Flag	Coverage Δ
bddtests	`95.99% <ø> (-0.38%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

tiagolobocastro · 2024-11-07T14:35:08Z

design/enable-selinux-mount.md

+   - Pod must specify SELinux level
+   - PV must be RWOP.
+
+Note: I'm unsure this is necessary or makes sense to document, thoughts?


Yes I think it's good to document the requirements.

tiagolobocastro · 2024-11-07T14:35:56Z

deploy/zfs-operator.yaml

  attachRequired: false
  podInfoOnMount: false
  storageCapacity: true
+  seLinuxMount: true


Suggested change

seLinuxMount: true

{{- if semverCompare ">= 1.25.x" .Capabilities.KubeVersion.Version }}

seLinuxMount: true

{{- end }}

tiagolobocastro · 2024-11-07T14:36:30Z

deploy/helm/charts/templates/csidriver.yaml

  attachRequired: false
  podInfoOnMount: false
  storageCapacity: {{ .Values.feature.storageCapacity }}
+  seLinuxMount: true


It seems to be accepted from 1.25.x, so I suggest this:

Suggested change

seLinuxMount: true

{{- if semverCompare ">= 1.25.x" .Capabilities.KubeVersion.Version }}

seLinuxMount: true

{{- end }}

tiagolobocastro · 2024-12-05T10:16:14Z

Any updates here @cjorge-graphops ?

cjorge-graphops · 2024-12-14T11:58:21Z

Any updates here @cjorge-graphops ?

I'm sorry, have been pressed for time. I will be able to address all the points raised here and try to push this forward soon (end of December / very early January) - and ofc, anyone can feel free to do so if they wish to do so earlier 🙇

I'll also document better the requirements as expressed, but just to leave a heads-up: this seLinuxMount functionality on k8s is still being worked and developed further (expanded to relax some of the constraints). As such that documentation will need to be kept up to date over the next months/year as the SIG evolves. I don't mind doing my best to maintain it, but I don't expect I'll be faster at it than this PR has been like through 2025... which leaves a bit to be desired in terms of being timely.

Abhinandan-Purkait · 2024-12-16T11:16:36Z

Any updates here @cjorge-graphops ?

I'm sorry, have been pressed for time. I will be able to address all the points raised here and try to push this forward soon (end of December / very early January) - and ofc, anyone can feel free to do so if they wish to do so earlier 🙇

I'll also document better the requirements as expressed, but just to leave a heads-up: this seLinuxMount functionality on k8s is still being worked and developed further (expanded to relax some of the constraints). As such that documentation will need to be kept up to date over the next months/year as the SIG evolves. I don't mind doing my best to maintain it, but I don't expect I'll be faster at it than this PR has been like through 2025... which leaves a bit to be desired in terms of being timely.

That's great. Thanks for the contribution, looking forward to the changes.

feat(csidriver): declare seLinuxMount support

36620f7

Signed-off-by: Carlos Jorge <[email protected]>

sinhaashish self-requested a review November 4, 2024 05:43

Abhinandan-Purkait reviewed Nov 4, 2024

View reviewed changes

tiagolobocastro reviewed Nov 7, 2024

View reviewed changes

Abhinandan-Purkait requested a review from a team as a code owner October 13, 2025 16:53

feat(csidriver): declare seLinuxMount support #598

Are you sure you want to change the base?

feat(csidriver): declare seLinuxMount support #598

Uh oh!

Conversation

cjorge-graphops commented Nov 1, 2024

Pull Request template

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codecov-commenter commented Nov 4, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tiagolobocastro commented Dec 5, 2024

Uh oh!

cjorge-graphops commented Dec 14, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Abhinandan-Purkait commented Dec 16, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

codecov-commenter commented Nov 4, 2024 •

edited

Loading

cjorge-graphops commented Dec 14, 2024 •

edited

Loading