ceph / ceph/ceph-csi-operator

Helm: default driver log rotation not compatible with default privileged value.

Open
#577 2 comments 0 reactions 1 assignee Claimed by @abhinav-phi View on GitHub
Dominant language
Go
Stars
63
Forks
59
Avg merge
1d 19h
Merged PRs (30d)
19

Description

# Describe the bug #

Deploying the drivers with their default values results in driver controllers failing to start due to SELinux labeling on the log-dir.

# Environment details #

- Image/version of ceph-csi-operator : 1.0.4
- Image/version of Ceph-CSI driver : 3.17.0
- Kubernetes cluster version : 1.36.3
- Ceph cluster version : 20.2.1

# Steps to reproduce #

Steps to reproduce the behavior:

1. Deploy a driver using the helm chart with defaults for log.rotation.enabled (true) and controllerPlugin.privileged (false)
2. On any host with SELinux in enforcing mode, note that the driver controller fails to start.

# Additional context #

The controller pods are deployed with securityContext.privileged: false, but also have --log_file args referencing volumeMounts from hostPath volumes from the host's /var/lib/cephcsi/ directory.

The SELinux labels for the /var/lib/cephcsi/ are either system_u:object_r:container_file_t:s0 (or system_u:object_r:var_lib_t:s0 after a system relabel, after for example a host package upgrade).

The process is running with a MCS context, eg system_u:system_r:container_t:s0:c321,c556, which is unable to access the hostPath.

Kubernetes does not relabel hostPath directories to prevent breaking host processes (only PVC's, projected volumes etc are relabeled).

The operator should probably ignore the privileged: false setting if hostPath log directories are used, or support explicit securityContext settings for the controller which could be used with an privileged initContainer to correctly set the SELinux labels for the hostPath.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.