Merge pull request #33555 from rustyrobot/fix-selinux-rules-discovery

Automatic merge from submit-queue Kubeadm: fix SELinux rules for kubernetes discovery service **What this PR does / why we need it**: Fixes problems with SELinux on CentOS for discovery container which cannot read data from `/tmp/secret` directory. **Which issue this PR fixes** Fixed #33541

Merge pull request #33555 from rustyrobot/fix-selinux-rules-discovery
80be079c · Kubernetes Submit Queue · GitHub · 354f003c · 8f586d91 · 80be079c
Commit 80be079c authored Sep 27, 2016 by Kubernetes Submit Queue Committed by GitHub Sep 27, 2016
Hide whitespace changes
Inline Side-by-side

Showing with 9 additions and 0 deletions

discovery.go cmd/kubeadm/app/master/discovery.go +9 -0

No files found.
--- a/cmd/kubeadm/app/master/discovery.go
+++ b/cmd/kubeadm/app/master/discovery.go
@@ -81,6 +81,15 @@ func newKubeDiscoveryPodSpec(s *kubeadmapi.KubeadmConfig) api.PodSpec {
 				// `HostIP: s.API.AdvertiseAddrs[0]`, if there is only one address`
 				{Name: "http", ContainerPort: 9898, HostPort: 9898},
 			},
+			SecurityContext: &api.SecurityContext{
+				SELinuxOptions: &api.SELinuxOptions{
+					// TODO: This implies our discovery container is not being restricted by
+					// SELinux. This is not optimal and would be nice to adjust in future
+					// so it can read /tmp/secret, but for now this avoids recommending
+					// setenforce 0 system-wide.
+					Type: "unconfined_t",
+				},
+			},
 		}},
 		Volumes: []api.Volume{{
 			Name: kubeDiscoverySecretName,