Helm: default driver log rotation not compatible with default privileged value.
- Dominant language
- Go
- Stars
- 63
- Forks
- 59
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 19
Description
# Describe the bug #
Deploying the drivers with their default values results in driver controllers failing to start due to SELinux labeling on the log-dir.
# Environment details #
- Image/version of ceph-csi-operator : 1.0.4
- Image/version of Ceph-CSI driver : 3.17.0
- Kubernetes cluster version : 1.36.3
- Ceph cluster version : 20.2.1
# Steps to reproduce #
Steps to reproduce the behavior:
1. Deploy a driver using the helm chart with defaults for log.rotation.enabled (true) and controllerPlugin.privileged (false)
2. On any host with SELinux in enforcing mode, note that the driver controller fails to start.
# Additional context #
The controller pods are deployed with securityContext.privileged: false, but also have --log_file args referencing volumeMounts from hostPath volumes from the host's /var/lib/cephcsi/ directory.
The SELinux labels for the /var/lib/cephcsi/ are either system_u:object_r:container_file_t:s0 (or system_u:object_r:var_lib_t:s0 after a system relabel, after for example a host package upgrade).
The process is running with a MCS context, eg system_u:system_r:container_t:s0:c321,c556, which is unable to access the hostPath.
Kubernetes does not relabel hostPath directories to prevent breaking host processes (only PVC's, projected volumes etc are relabeled).
The operator should probably ignore the privileged: false setting if hostPath log directories are used, or support explicit securityContext settings for the controller which could be used with an privileged initContainer to correctly set the SELinux labels for the hostPath.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.