Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cannot use volume and volume_mount when SELinux is set to enforcing. #185

Open
jdoss opened this issue Jul 22, 2022 · 0 comments
Open

Cannot use volume and volume_mount when SELinux is set to enforcing. #185

jdoss opened this issue Jul 22, 2022 · 0 comments

Comments

@jdoss
Copy link
Contributor

jdoss commented Jul 22, 2022

It seems that I can't mount any kind of directory with the CSI hostpath plugin using volume and volume_mount directives.

group "victoriametrics" {
    count = 1

    restart {
      attempts = 10
      interval = "5m"
      delay = "25s"
      mode = "delay"
    }

    network {
      port "http" {
        to = 8428
      }
    }

    service {
      name = "victoriametrics"
      tags = ["metrics", "victoriametrics"]
      meta {
        nomad_alloc_id = "${NOMAD_SHORT_ALLOC_ID}"
        }
      provider = "consul"
      port = "http"
    }

    service {
      name = "influxdb"
      tags = ["metrics", "influxdb"]
      meta {
        nomad_alloc_id = "${NOMAD_SHORT_ALLOC_ID}"
        }
      provider = "consul"
      port = "http"
    }

    volume "victoriametrics" {
      type      = "csi"
      source    = "victoriametrics"
      read_only = false
      attachment_mode = "file-system"
      access_mode     = "single-node-writer"
    }

    task "http" {
      driver = "podman"

      volume_mount {
        volume      = "victoriametrics"
        destination = "/victoria-metrics-data"
        read_only   = false
      }

      config {
        image = "docker.io/victoriametrics/victoria-metrics:v1.79.0"
        ports = ["http"]

        # volumes = [
        #   "/opt/nomad/storage/victoria-metrics-data:/victoria-metrics-data:z"
        # ]
      }

      resources {
        cpu    = 600 # MHz
        memory = 768 # MB
      }
    }

With the above config the allocation fails over and over again. Disabling SELinux client node wide (something I'd like to avoid) or manually adding container_file_t to /opt/nomad/data/ (which is effectively :z on a volume mount) to my nomad data directory works around the issue.

# chcon system_u:object_r:container_file_t:s0 /opt/nomad/data/ -R

I believe this is related to the bigger conversation in hashicorp/nomad#9123 but maybe #139 could get merged so I could use security_opt = ["label=disable"] as a stop gap to disable SELinux on my container workloads that need persistent storage.

Ideally, it would be cool to just add selinuxlabel = "z" to volume_mount blocks so we can handle SELinux labeling:

volume_mount {
        volume      = "victoriametrics"
        destination = "/victoria-metrics-data"
        read_only   = false
        selinuxlabel = "z"
      }

on a per mount basis or inherit selinuxlabel = "z" from

plugin "nomad-driver-podman" {
          config {
            volumes {
              enabled      = true
              selinuxlabel = "z"
            }
          }
        }
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Status: Needs Roadmapping
Development

No branches or pull requests

2 participants