Merge pull request #8547 from humblec/selinux

csi: mount host's /etc/selinux in node plugins

Documentation/helm-operator.md

@@ -110,6 +110,7 @@ The following tables lists the configurable parameters of the rook-operator char
 | `csi.provisionerReplicas`           | Set replicas for csi provisioner deployment.                                                                                | `2`                                                       |
 | `csi.enableGrpcMetrics`             | Enable Ceph CSI GRPC Metrics.                                                                                               | `false`                                                   |
 | `csi.enableCSIHostNetwork`          | Enable Host Networking for Ceph CSI nodeplugins.                                                                            | `false`                                                   |
+| `csi.enablePluginSelinuxHostMount`  | Enable Host mount for /etc/selinux directory for Ceph CSI nodeplugins.                                                      | `false`                                                   |
 | `csi.provisionerTolerations`        | Array of tolerations in YAML format which will be added to CSI provisioner deployment.                                      | <none>                                                    |
 | `csi.provisionerNodeAffinity`       | The node labels for affinity of the CSI provisioner deployment (***)                                                        | <none>                                                    |
 | `csi.pluginTolerations`             | Array of tolerations in YAML format which will be added to CephCSI plugin DaemonSet                                         | <none>                                                    |

deploy/charts/rook-ceph/templates/deployment.yaml

@@ -89,6 +89,8 @@ spec:
           value: {{ .Values.csi.enableOMAPGenerator | quote }}
         - name: CSI_ENABLE_VOLUME_REPLICATION
           value: {{ .Values.csi.volumeReplication.enabled | quote }}
+        - name: CSI_PLUGIN_ENABLE_SELINUX_HOST_MOUNT
+          value: {{ .Values.csi.enablePluginSelinuxHostMount | quote }}
 {{- if .Values.csi.enableCSIHostNetwork }}
         - name: CSI_ENABLE_HOST_NETWORK
           value: {{ .Values.csi.enableCSIHostNetwork | quote }}

deploy/charts/rook-ceph/values.yaml

@@ -66,6 +66,8 @@ csi:
   enableCephfsSnapshotter: true
   # set to false to disable deployment of snapshotter container in RBD provisioner pod.
   enableRBDSnapshotter: true
+  # set to false if the selinux is not enabled or unavailable in cluster nodes.
+  enablePluginSelinuxHostMount : false
   # (Optional) set user created priorityclassName for csi plugin pods.
   # pluginPriorityClassName: system-node-critical
 

deploy/examples/operator-openshift.yaml

@@ -154,6 +154,10 @@ data:
 
   # (Optional) Allow starting unsupported ceph-csi image
   ROOK_CSI_ALLOW_UNSUPPORTED_VERSION: "false"
+
+  # (Optional) control the host mount of /etc/selinux for csi plugin pods.
+  CSI_PLUGIN_ENABLE_SELINUX_HOST_MOUNT: "false"
+
   # The default version of CSI supported by Rook will be started. To change the version
   # of the CSI driver to something other than what is officially supported, change
   # these images to the desired release of the CSI driver.

deploy/examples/operator.yaml

@@ -72,6 +72,10 @@ data:
 
   # (Optional) Allow starting unsupported ceph-csi image
   ROOK_CSI_ALLOW_UNSUPPORTED_VERSION: "false"
+
+  # (Optional) control the host mount of /etc/selinux for csi plugin pods.
+  CSI_PLUGIN_ENABLE_SELINUX_HOST_MOUNT: "false"
+
   # The default version of CSI supported by Rook will be started. To change the version
   # of the CSI driver to something other than what is officially supported, change
   # these images to the desired release of the CSI driver.

pkg/operator/ceph/csi/spec.go

@@ -51,6 +51,7 @@ type Param struct {
 	PluginPriorityClassName        string
 	ProvisionerPriorityClassName   string
 	VolumeReplicationImage         string
+	EnablePluginSelinuxHostMount   bool
 	EnableCSIHostNetwork           bool
 	EnableOMAPGenerator            bool
 	EnableRBDSnapshotter           bool
@@ -316,6 +317,10 @@ func (r *ReconcileCSI) startDrivers(ver *version.Info, ownerInfo *k8sutil.OwnerI
 		tp.RBDPluginUpdateStrategy = rollingUpdate
 	}
 
+	if strings.EqualFold(k8sutil.GetValue(r.opConfig.Parameters, "CSI_PLUGIN_ENABLE_SELINUX_HOST_MOUNT", "false"), "true") {
+		tp.EnablePluginSelinuxHostMount = true
+	}
+
 	logger.Infof("Kubernetes version is %s.%s", ver.Major, ver.Minor)
 
 	tp.ResizerImage = k8sutil.GetValue(r.opConfig.Parameters, "ROOK_CSI_RESIZER_IMAGE", DefaultResizerImage)

pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin.yaml

@@ -105,6 +105,11 @@ spec:
               mountPath: /tmp/csi/keys
             - name: host-run-mount
               mountPath: /run/mount
+            {{ if .EnablePluginSelinuxHostMount }}
+            -  name: etc-selinux
+               mountPath: /etc/selinux
+               readOnly: true
+            {{ end }}
         - name: liveness-prometheus
           securityContext:
             privileged: true
@@ -166,3 +171,8 @@ spec:
         - name: host-run-mount
           hostPath:
             path: /run/mount
+        {{ if .EnablePluginSelinuxHostMount }}
+        - name: etc-selinux
+          hostPath:
+            path: /etc/selinux
+        {{ end }}

pkg/operator/ceph/csi/template/rbd/csi-rbdplugin.yaml

@@ -106,6 +106,11 @@ spec:
               mountPath: /tmp/csi/keys
             - name: host-run-mount
               mountPath: /run/mount
+            {{ if .EnablePluginSelinuxHostMount }}
+            - name: etc-selinux
+              mountPath: /etc/selinux
+              readOnly: true
+            {{ end }}
         - name: liveness-prometheus
           securityContext:
             privileged: true
@@ -176,3 +181,8 @@ spec:
         - name: host-run-mount
           hostPath:
             path: /run/mount
+        {{ if .EnablePluginSelinuxHostMount }}
+        - name: etc-selinux
+          hostPath:
+            path: /etc/selinux
+        {{ end }}