Pod level SELinux context and volumes #14192

pmorie · 2015-09-18T18:50:32Z

Splitting from #12944; this proposal covers just SELinux and generic label management for volumes.

Next step is discussion of API backward compatibility issues.

@pweil- @swagiaal @smarterclayton @childsb @wattsteve

k8s-bot · 2015-09-18T19:28:09Z

GCE e2e build/test passed for commit 73cb59af1d516e0111e1036906ed88e38c06d35f.

k8s-github-robot · 2015-09-18T19:50:24Z

Labelling this PR as size/L

pmorie · 2015-09-19T16:13:59Z

@rootfs @thockin @saad-ali @vishh

rootfs · 2015-09-21T14:04:12Z

I think hostPath is in the bag. If that is done, and we are able to transform the remote storage to hostPath via loopback (assuming we are able to solve the performance problem), would that help slim the matrix? Some remote volume are not able to read SELinux labels.

pmorie · 2015-09-21T16:14:15Z

@rootfs Is what you're proposing only for shared storage? Remote block devices should support writing SELinux xattrs just fine.

smarterclayton · 2015-09-21T16:14:51Z

Needs backcompat statement filled out.

pmorie · 2015-09-21T16:26:31Z

@smarterclayton Oh yes, I'm aware :) That's next.

On Mon, Sep 21, 2015 at 12:14 PM, Clayton Coleman notifications@github.com
wrote:

Needs backcompat statement filled out.

—
Reply to this email directly or view it on GitHub
#14192 (comment)
.

brendandburns · 2015-09-23T17:26:29Z

switching review to @smarterclayton since he has SELinux context that I lack.

smarterclayton · 2015-09-23T17:52:13Z

I agree with all of this, but I would like @thockin to once over because of general volume design and @bgrant0607 to ack the API change that I believe he was ok with in the parent issue.

bgrant0607 · 2015-09-23T18:25:19Z

docs/proposals/selinux.md

+
+#### API backward compatibility
+
+TODO


@bgrant0607 Also on my list for today, this depended on getting the story right with #12823 before it could be done without wasting time. The story I'm going to write today is much simpler than the one I would have written when the TODO went in.

k8s-bot · 2015-09-25T18:40:54Z

GCE e2e build/test passed for commit 92466181f93adc582df2ed77848eb091cd93aae7.

pmorie · 2015-09-25T21:11:36Z

@thockin Most of your feedback should be addressed mod block devices in read-only mode.

pmorie · 2015-09-25T21:12:00Z

@swagiaal @pweil- @rootfs @childsb @wattsteve

k8s-bot · 2015-09-25T21:46:40Z

Unit, integration and GCE e2e test build/test passed for commit b2e967e.

thockin · 2015-09-25T23:30:50Z

Travis says: run hack/update-generated-docs.sh

thockin · 2015-09-25T23:35:56Z

docs/proposals/selinux.md

+
+Kubernetes volumes can be divided into two broad categories:
+
+1.  Unshared storage:


This taxonomy is really the same as the PV taxonomy: RWO, ROX, RWX

Specifically your 1.2 is a lie. Most block devices support single-writer or multi-reader modes

ack; I'll rewrite.

@thockin So, is it really that 1.2 needs to be split into:

Use of network block devices without using PVs

Use of network block devices with PVs in ReadWriteOnce mode

Use of network block devices with PVs in *Many modes

I think (1) and (2) go where 1.2 is now, and (3) should be another bullet in 'shared storage'

@markturansky @wattsteve @childsb @swagiaal

I think the use of "Unshared" vs "Shared" is confusing here. The real dividing line is "Volumes which support client side chcon" and "volumes which do not"

I don't agree, @swagiaal. For example, in the use-case where you have a network block device being used via a PV in ReadOnlyMany mode, I don't think you want to do the chcon, even though the block device supports it. I think that falls into the same category as NFS, where you can't really do the chcon from the client side (due to the security risk you take on) even if you're in ReadWriteOnce PV mode.

To expand a little bit more, if you're using a block device-based volume that supports chcon in one of the Many PV modes, I think you have problems similar to 'shared' FSs like NFS, etc:

Which context is the right one to use?

How should manage the context?

I'm inclined to say the right point at which to solve the above questions is when such a volume is provisioned rather than when it is mounted into a pod.

I'm leaning towards rewriting this section when I make a pass back through this doc.

@wattsteve @childsb Opinions welcome, since this recasts the framework we've been talking about volumes in terms of slightly. PTAL

@swagiaal For the record, I didn't disagree about being confusing, only on how you were partitioning the space of volumes/FSs.

i think we should lump the 1 write multiple read use case into the shared storage category and fully address it in the next iteration.

k8s-bot · 2015-09-26T17:53:36Z

Unit, integration and GCE e2e build/test failed for commit dd2a3bfcd35f3bf060cafad6d651c2b31a4ad0f5.

pmorie · 2015-09-30T23:21:12Z

@thockin I think this should be ready for review now. How about I owe you one beer per PR?*

*terms and conditions apply

k8s-bot · 2015-10-01T00:01:01Z

Unit, integration and GCE e2e build/test failed for commit f37423e4690e4c46e6addf77c64ffef53e4960ca.

k8s-bot · 2015-10-01T00:18:47Z

Unit, integration and GCE e2e test build/test passed for commit 7f049b7.

sdminonne · 2015-10-02T13:49:39Z

cc @EricMountain-1A

thockin · 2015-10-02T18:12:11Z

docs/proposals/selinux.md

+### Kubernetes
+
+
+There is a [proposed change](https://github.com/GoogleCloudPlatform/kubernetes/pull/9844) to the


does this mean we close #9844?

Already closed!

thockin · 2015-10-02T18:29:29Z

L
G
T
M

pmorie · 2015-10-02T18:35:53Z

Thanks a lot @thockin

smarterclayton · 2015-10-02T18:52:34Z

+1 for that

On Oct 2, 2015, at 2:36 PM, Paul Morie notifications@github.com wrote:

Thanks a lot @thockin https://github.com/thockin

—
Reply to this email directly or view it on GitHub
#14192 (comment)
.

pmorie · 2015-10-05T18:07:13Z

@k8s-oncall

Pod level SELinux context and volumes

googlebot added the cla: yes label Sep 18, 2015

k8s-github-robot assigned brendandburns Sep 18, 2015

k8s-github-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Sep 18, 2015

brendandburns assigned smarterclayton and unassigned brendandburns Sep 23, 2015

bgrant0607 reviewed Sep 23, 2015
View reviewed changes

pmorie force-pushed the generic-selinux branch from 73cb59a to 9246618 Compare September 25, 2015 18:13

pmorie force-pushed the generic-selinux branch from 9246618 to b2e967e Compare September 25, 2015 21:10

thockin reviewed Sep 25, 2015
View reviewed changes

pmorie force-pushed the generic-selinux branch from b2e967e to dd2a3bf Compare September 26, 2015 17:43

pmorie force-pushed the generic-selinux branch from dd2a3bf to f37423e Compare September 30, 2015 23:18

Proposal: generic SELinux support for volumes

7f049b7

pmorie force-pushed the generic-selinux branch from f37423e to 7f049b7 Compare September 30, 2015 23:20

bgrant0607 added the team/api label Oct 1, 2015

pmorie mentioned this pull request Oct 1, 2015

WIP: Emptydir and security context #9844

Closed

thockin reviewed Oct 2, 2015
View reviewed changes

thockin added lgtm "Looks good to me", indicates that a PR is ready to be merged. e2e-not-required labels Oct 2, 2015

pmorie changed the title ~~WIP: pod level SELinux context and volumes~~ Pod level SELinux context and volumes Oct 5, 2015

a-robinson added a commit that referenced this pull request Oct 5, 2015

Merge pull request #14192 from pmorie/generic-selinux

a81545d

Pod level SELinux context and volumes

a-robinson merged commit a81545d into kubernetes:master Oct 5, 2015

ghost mentioned this pull request Oct 8, 2015

Support labeling of volumes to Pod's SELinux label #15323

Merged

pmorie mentioned this pull request Oct 19, 2015

SELinux and Kubernetes #15883

Closed

yifan-gu mentioned this pull request Apr 1, 2016

Add --selinux-options to rkt run and rkt run-prepared rkt/rkt#2361

Closed

xingzhou pushed a commit to xingzhou/kubernetes that referenced this pull request Dec 15, 2016

Merge pull request kubernetes#14192 from pmorie/generic-selinux

70ab638

Pod level SELinux context and volumes


		Kubernetes volumes can be divided into two broad categories:

		1. Unshared storage:

		### Kubernetes


		There is a [proposed change](https://github.com/GoogleCloudPlatform/kubernetes/pull/9844) to the

Pod level SELinux context and volumes #14192

Pod level SELinux context and volumes #14192

Conversation

pmorie commented Sep 18, 2015

k8s-bot commented Sep 18, 2015

k8s-github-robot commented Sep 18, 2015

pmorie commented Sep 19, 2015

rootfs commented Sep 21, 2015

pmorie commented Sep 21, 2015

smarterclayton commented Sep 21, 2015

pmorie commented Sep 21, 2015

brendandburns commented Sep 23, 2015

smarterclayton commented Sep 23, 2015

Choose a reason for hiding this comment

Choose a reason for hiding this comment

k8s-bot commented Sep 25, 2015

pmorie commented Sep 25, 2015

pmorie commented Sep 25, 2015

k8s-bot commented Sep 25, 2015

thockin commented Sep 25, 2015

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

k8s-bot commented Sep 26, 2015

pmorie commented Sep 30, 2015

k8s-bot commented Oct 1, 2015

k8s-bot commented Oct 1, 2015

sdminonne commented Oct 2, 2015

Choose a reason for hiding this comment

Choose a reason for hiding this comment

thockin commented Oct 2, 2015

pmorie commented Oct 2, 2015

smarterclayton commented Oct 2, 2015

pmorie commented Oct 5, 2015