Speed up recursive SELinux label change

[jsafrane]

Enhancement Description

• One-line enhancement description (can be used as a release note): Speed up container startup by mounting volumes with the correct SELInux label instead of changing each file on the volumes recursively.

• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/tree/master/keps/sig-storage/1710-selinux-relabeling

• Primary contact (assignee): @jsafrane

• Responsible SIGs: sig-storage, sig-node

The KEP describes 3 phases / 3 feature gates.

SELinuxMountReadWriteOncePod:

• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y): 1.24
  • Beta release target (x.y): 1.27
  • Stable release target (x.y): 1.36
• Alpha
  • KEP (k/enhancements) update PR(s):
  • Code (k/k) update PR(s):
  • Docs (k/website) update PR(s):
• Beta
  • KEP (k/enhancements) update PR(s):
    • KEP-1710: Update SELinux mount ReadWriteOnce optimization for beta #3797
  • Code (k/k) update PR(s):
    • Flip SELinuxMountReadWriteOncePod to Beta kubernetes#116425
  • Docs (k/website) update(s):
    • Add blog for Efficient SELinux volume relabeling (Beta) website#39836
• GA
  • KEP (k/enhancements) update PR(s): 1710: Graduate SELinuxChangePolicy and SELinuxMountReadWriteOncePod to GA #5783
  • Code (k/k) update PR(s): Promote SELinuxChangePolicy & SELinuxMountReadWriteOncePod to GA kubernetes#136912
  • Docs (k/website) update(s): Graduate initial SELinuxMount features to GA website#54622

SELinuxChangePolicy

• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y): 1.32
  • Beta release target (x.y): 1.33
  • Stable release target (x.y): 1.36
• Alpha
  • KEP (k/enhancements) update PR(s): 1710: Add SELinuxChangePolicy to PodSpec #4843
  • Code (k/k) update PR(s):
    • 1710: Implement SELinuxChangePolicy kubernetes#127981
    • 1710: Add SELinux warning controller kubernetes#128242
    • new/updated test jobs:
  • Docs (k/website) update PR(s):
    • Document SELinuxChangePolicy and SELinuxMount website#48515
• Beta
  • KEP (k/enhancements) update PR(s): 1710: selinux: Update the KEP for 1.33 and graduate to Beta #5096
  • Code (k/k) update PR(s): selinux: Promote SELinuxChangePolicy and SELinuxMount to beta kubernetes#130544
  • Docs (k/website) update(s): Announce improved SELinux volume relabelling beta website#49919
• GA
  • KEP (k/enhancements) update PR(s): 1710: Graduate SELinuxChangePolicy and SELinuxMountReadWriteOncePod to GA #5783
  • Code (k/k) update PR(s): Promote SELinuxChangePolicy & SELinuxMountReadWriteOncePod to GA kubernetes#136912
  • Docs (k/website) update(s): Graduate initial SELinuxMount features to GA website#54622, blog Blog for breaking SELinux changes in 1.37 website#54779

SELinuxMount

• Enhancement target (which target equals to which milestone):

  • Alpha release target (x.y): 1.30
  • Beta release target (x.y): 1.33
  • Stable release target (x.y): ≥ 1.37

• Alpha

  • KEP (k/enhancements) update PR(s): Start SELinuxMount alpha #4436
  • Code (k/k) update PR(s):
    • Add SELinuxMount feature gate kubernetes#123157
    • Add label with access mode to SELinux metrics kubernetes#123667
    • new/updated test jobs:
      • Add CI job for SELinuxMount feature gate test-infra#32125
      • Fix typo in e2e-kops-aws-selinux skips test-infra#32143
      • https://testgrid.k8s.io/google-aws#kops-aws-selinux
      • https://testgrid.k8s.io/google-aws#kops-aws-selinux-alpha
  • Docs (k/website) update PR(s): Document SELinuxMount feature gate website#45280

• Beta

  • KEP (k/enhancements) update PR(s): 1710: selinux: Update the KEP for 1.33 and graduate to Beta #5096 (same as SELinuxChangePolicy)
  • Code (k/k) update PR(s): selinux: Promote SELinuxChangePolicy and SELinuxMount to beta kubernetes#130544
  • Docs (k/website) update(s): Announce improved SELinux volume relabelling beta website#49919

• GA

  • KEP (k/enhancements) update PR(s): KEP-1710: Promote SELinux mount to GA #6112
  • Code (k/k) update PR(s): Graduate SELinuxMount to GA kubernetes#139956
  • Docs (k/website) update(s): KEP 1710: Graduate SELinuxMount to GA in 1.37 website#56251

[jsafrane]

/sig storage
/sig node

[palnabarun]

Hey @jsafrane -- 1.19 Enhancements Lead here. I wanted to check in and see if you think this Enhancement will be graduating in 1.19?

In order to have this part of the release:

1. The KEP PR must be merged in an implementable state
2. The KEP must have test plans
3. The KEP must have graduation criteria.

---

The current release schedule is:

• Monday, April 13: Week 1 - Release cycle begins
• Tuesday, May 19: Week 6 - Enhancements Freeze
• Thursday, June 25: Week 11 - Code Freeze
• Thursday, July 9: Week 14 - Docs must be completed and reviewed
• Tuesday, August 4: Week 17 - Kubernetes v1.19.0 released

[palnabarun]

Hi @jsafrane,

Tomorrow, Tuesday May 19 EOD Pacific Time is Enhancements Freeze

Will this enhancement be part of the 1.19 release cycle?

[palnabarun]

@jsafrane -- Unfortunately, the deadline for the 1.19 Enhancement freeze has passed. For now, this is being removed from the milestone and 1.19 tracking sheet. If there is a need to get this in, please file an enhancement exception.

[jsafrane]

@palnabarun hey, we've just merged the KEP yesterday, at the last moment. I admit I did not pay attention to this enhancement issue and focused on the design. Do I really need an exception just to restore the milestone?

[palnabarun]

Do I really need an exception just to restore the milestone?

Yes, an exception would be needed. Here is the process on how to file and exception request.

[palnabarun]

@jsafrane -- Your exception request was approved. I have updated the tracking sheet accordingly.

[palnabarun]

/milestone v1.19