From e5f5d9be9f6ec8705e06c24a3f58ed5273572d43 Mon Sep 17 00:00:00 2001 From: Humble Chirammal Date: Tue, 17 Aug 2021 09:50:54 +0530 Subject: [PATCH] csi: mount host's /etc/selinux in node plugins This commit introduces a new configuration option for ceph csi driver to enable hostpath mounting of /etc/selinux directory from the cluster node where csi plugin pods are running, which inturn help the csi driver to specify selinux-related mount options like context. Ref# https://github.com/ceph/ceph-csi/issues/2295 The default value for this configuration is true and if cluster nodes are running without selinux enabled, an admin can deploy csi pods by specifying this option to `false` which skip the host path mounting for the csi pods. Signed-off-by: Humble Chirammal --- Documentation/helm-operator.md | 1 + deploy/charts/rook-ceph/templates/deployment.yaml | 2 ++ deploy/charts/rook-ceph/values.yaml | 2 ++ deploy/examples/operator-openshift.yaml | 4 ++++ deploy/examples/operator.yaml | 4 ++++ pkg/operator/ceph/csi/spec.go | 5 +++++ .../ceph/csi/template/cephfs/csi-cephfsplugin.yaml | 10 ++++++++++ pkg/operator/ceph/csi/template/rbd/csi-rbdplugin.yaml | 10 ++++++++++ 8 files changed, 38 insertions(+) diff --git a/Documentation/helm-operator.md b/Documentation/helm-operator.md index 1febdd809..5e69ab793 100644 --- a/Documentation/helm-operator.md +++ b/Documentation/helm-operator.md @@ -110,6 +110,7 @@ The following tables lists the configurable parameters of the rook-operator char | `csi.provisionerReplicas` | Set replicas for csi provisioner deployment. | `2` | | `csi.enableGrpcMetrics` | Enable Ceph CSI GRPC Metrics. | `false` | | `csi.enableCSIHostNetwork` | Enable Host Networking for Ceph CSI nodeplugins. | `false` | +| `csi.enablePluginSelinuxHostMount` | Enable Host mount for /etc/selinux directory for Ceph CSI nodeplugins. | `false` | | `csi.provisionerTolerations` | Array of tolerations in YAML format which will be added to CSI provisioner deployment. | | | `csi.provisionerNodeAffinity` | The node labels for affinity of the CSI provisioner deployment (***) | | | `csi.pluginTolerations` | Array of tolerations in YAML format which will be added to CephCSI plugin DaemonSet | | diff --git a/deploy/charts/rook-ceph/templates/deployment.yaml b/deploy/charts/rook-ceph/templates/deployment.yaml index 9eb1c4607..879cb66ed 100644 --- a/deploy/charts/rook-ceph/templates/deployment.yaml +++ b/deploy/charts/rook-ceph/templates/deployment.yaml @@ -89,6 +89,8 @@ spec: value: {{ .Values.csi.enableOMAPGenerator | quote }} - name: CSI_ENABLE_VOLUME_REPLICATION value: {{ .Values.csi.volumeReplication.enabled | quote }} + - name: CSI_PLUGIN_ENABLE_SELINUX_HOST_MOUNT + value: {{ .Values.csi.enablePluginSelinuxHostMount | quote }} {{- if .Values.csi.enableCSIHostNetwork }} - name: CSI_ENABLE_HOST_NETWORK value: {{ .Values.csi.enableCSIHostNetwork | quote }} diff --git a/deploy/charts/rook-ceph/values.yaml b/deploy/charts/rook-ceph/values.yaml index a13b7bae1..bca7cfdec 100644 --- a/deploy/charts/rook-ceph/values.yaml +++ b/deploy/charts/rook-ceph/values.yaml @@ -66,6 +66,8 @@ csi: enableCephfsSnapshotter: true # set to false to disable deployment of snapshotter container in RBD provisioner pod. enableRBDSnapshotter: true + # set to false if the selinux is not enabled or unavailable in cluster nodes. + enablePluginSelinuxHostMount : false # (Optional) set user created priorityclassName for csi plugin pods. # pluginPriorityClassName: system-node-critical diff --git a/deploy/examples/operator-openshift.yaml b/deploy/examples/operator-openshift.yaml index 6ac93d0f8..e16a75e0f 100644 --- a/deploy/examples/operator-openshift.yaml +++ b/deploy/examples/operator-openshift.yaml @@ -154,6 +154,10 @@ data: # (Optional) Allow starting unsupported ceph-csi image ROOK_CSI_ALLOW_UNSUPPORTED_VERSION: "false" + + # (Optional) control the host mount of /etc/selinux for csi plugin pods. + CSI_PLUGIN_ENABLE_SELINUX_HOST_MOUNT: "false" + # The default version of CSI supported by Rook will be started. To change the version # of the CSI driver to something other than what is officially supported, change # these images to the desired release of the CSI driver. diff --git a/deploy/examples/operator.yaml b/deploy/examples/operator.yaml index 6e2512236..dafcd0199 100644 --- a/deploy/examples/operator.yaml +++ b/deploy/examples/operator.yaml @@ -72,6 +72,10 @@ data: # (Optional) Allow starting unsupported ceph-csi image ROOK_CSI_ALLOW_UNSUPPORTED_VERSION: "false" + + # (Optional) control the host mount of /etc/selinux for csi plugin pods. + CSI_PLUGIN_ENABLE_SELINUX_HOST_MOUNT: "false" + # The default version of CSI supported by Rook will be started. To change the version # of the CSI driver to something other than what is officially supported, change # these images to the desired release of the CSI driver. diff --git a/pkg/operator/ceph/csi/spec.go b/pkg/operator/ceph/csi/spec.go index 0acc12017..476b39c55 100644 --- a/pkg/operator/ceph/csi/spec.go +++ b/pkg/operator/ceph/csi/spec.go @@ -51,6 +51,7 @@ type Param struct { PluginPriorityClassName string ProvisionerPriorityClassName string VolumeReplicationImage string + EnablePluginSelinuxHostMount bool EnableCSIHostNetwork bool EnableOMAPGenerator bool EnableRBDSnapshotter bool @@ -316,6 +317,10 @@ func (r *ReconcileCSI) startDrivers(ver *version.Info, ownerInfo *k8sutil.OwnerI tp.RBDPluginUpdateStrategy = rollingUpdate } + if strings.EqualFold(k8sutil.GetValue(r.opConfig.Parameters, "CSI_PLUGIN_ENABLE_SELINUX_HOST_MOUNT", "false"), "true") { + tp.EnablePluginSelinuxHostMount = true + } + logger.Infof("Kubernetes version is %s.%s", ver.Major, ver.Minor) tp.ResizerImage = k8sutil.GetValue(r.opConfig.Parameters, "ROOK_CSI_RESIZER_IMAGE", DefaultResizerImage) diff --git a/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin.yaml b/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin.yaml index 31251daae..bf9eb76db 100644 --- a/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin.yaml +++ b/pkg/operator/ceph/csi/template/cephfs/csi-cephfsplugin.yaml @@ -105,6 +105,11 @@ spec: mountPath: /tmp/csi/keys - name: host-run-mount mountPath: /run/mount + {{ if .EnablePluginSelinuxHostMount }} + - name: etc-selinux + mountPath: /etc/selinux + readOnly: true + {{ end }} - name: liveness-prometheus securityContext: privileged: true @@ -166,3 +171,8 @@ spec: - name: host-run-mount hostPath: path: /run/mount + {{ if .EnablePluginSelinuxHostMount }} + - name: etc-selinux + hostPath: + path: /etc/selinux + {{ end }} diff --git a/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin.yaml b/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin.yaml index fe79929f2..b6d9767d2 100644 --- a/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin.yaml +++ b/pkg/operator/ceph/csi/template/rbd/csi-rbdplugin.yaml @@ -106,6 +106,11 @@ spec: mountPath: /tmp/csi/keys - name: host-run-mount mountPath: /run/mount + {{ if .EnablePluginSelinuxHostMount }} + - name: etc-selinux + mountPath: /etc/selinux + readOnly: true + {{ end }} - name: liveness-prometheus securityContext: privileged: true @@ -176,3 +181,8 @@ spec: - name: host-run-mount hostPath: path: /run/mount + {{ if .EnablePluginSelinuxHostMount }} + - name: etc-selinux + hostPath: + path: /etc/selinux + {{ end }}