Thanks to visit codestin.com
Credit goes to github.com

Skip to content

[1.21] server: conditionally relabel volumes given annotation #5406

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
openshift-merge-robot merged 8 commits into from
Oct 15, 2021
Merged

[1.21] server: conditionally relabel volumes given annotation #5406

openshift-merge-robot merged 8 commits into from
Oct 15, 2021

Conversation

@haircommander
Copy link
Member

@haircommander haircommander commented Oct 14, 2021

What type of PR is this?

/kind feature

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Add support for "io.kubernetes.cri-o.TrySkipVolumeSELinuxLabel" annotation, which tells CRI-O to skip relabeling volumes if the top level is already correctly labeled
Skip SELinux volume relabeling for super privileged containers (`securityContext.seLinuxOptions.type = "spc_t"`).

haircommander and others added 8 commits October 14, 2021 10:44
@haircommander
server: reduce args in addOCIBindMounts
676b2ef 
Signed-off-by: Peter Hunt <[email protected]>
@haircommander
test: refactor allowed_annotation tests
f1f4351 
Signed-off-by: Peter Hunt <[email protected]>
@haircommander
server: conditionally relabel volumes given annotation
20d8b00 
Signed-off-by: Peter Hunt <[email protected]>
@haircommander
server: FilterDisallowedAnnotations of containers earlier
3876955 
Signed-off-by: Peter Hunt <[email protected]>
@haircommander
test: fix selinux test failures
17ae1e1 
RHEL/CentOS 7's container-selinux package replaces container_file_t with svirt_sandbox_file_t
under the hood. This causes the annotation to not work correctly.

Signed-off-by: Peter Hunt <[email protected]>
@haircommander
vendor: update to selinux 1.9.1
86e90e0 
Signed-off-by: Peter Hunt <[email protected]>
@haircommander
test: skip certificate check for downloading parallel
69f1358 
Signed-off-by: Peter Hunt <[email protected]>
@saschagrunert @haircommander
Skip volume relabel for super privileged containers
6d3b20e 
If a container or pod specifies the SELinux type `spc_t`, then we skip
the volume relabel.

Signed-off-by: Sascha Grunert <[email protected]>
@openshift-ci openshift-ci bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. kind/feature Categorizes issue or PR as related to a new feature. labels Oct 14, 2021
@openshift-ci openshift-ci bot requested review from fidencio and nalind October 14, 2021 14:55
@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 14, 2021
@codecov
Copy link

codecov bot commented Oct 14, 2021

Codecov Report

Merging #5406 (1d58c59) into release-1.21 (e34bf50) will decrease coverage by 0.04%.
The diff coverage is 9.37%.

❗ Current head 1d58c59 differs from pull request most recent head 6d3b20e. Consider uploading reports for the commit 6d3b20e to get more accurate results

@@               Coverage Diff                @@
##           release-1.21    #5406      +/-   ##
================================================
- Coverage         44.95%   44.91%   -0.05%     
================================================
  Files               107      107              
  Lines             10966    10986      +20     
================================================
+ Hits               4930     4934       +4     
- Misses             5555     5571      +16     
  Partials            481      481

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Oct 14, 2021 •
edited
Loading

@haircommander: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/openshift-jenkins/integration_crun_cgroupv2 6d3b20e link false /test integration_cgroupv2
ci/openshift-jenkins/e2e_crun_cgroupv2 6d3b20e link false /test e2e_cgroupv2

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

saschagrunert
saschagrunert approved these changes Oct 15, 2021
View reviewed changes
Copy link
Member

@saschagrunert saschagrunert left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 15, 2021
@saschagrunert
Copy link
Member

saschagrunert commented Oct 15, 2021

/test e2e_rhel

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Oct 15, 2021

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: haircommander, saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:
  • OWNERS [haircommander,saschagrunert]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-bot
Copy link

openshift-bot commented Oct 15, 2021

/retest-required

Please review the full test history for this PR and help us cut down flakes.

5 similar comments
@openshift-bot
Copy link

openshift-bot commented Oct 15, 2021

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link

openshift-bot commented Oct 15, 2021

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link

openshift-bot commented Oct 15, 2021

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link

openshift-bot commented Oct 15, 2021

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link

openshift-bot commented Oct 15, 2021

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-merge-robot openshift-merge-robot merged commit 7415a53 into cri-o:release-1.21 Oct 15, 2021
@openshift-ci openshift-ci bot mentioned this pull request Mar 15, 2022
Closed
@jwenjian jwenjian mentioned this pull request Feb 3, 2023
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@saschagrunert saschagrunert saschagrunert approved these changes

@mrunalp mrunalp Awaiting requested review from mrunalp mrunalp is a code owner

@runcom runcom Awaiting requested review from runcom runcom is a code owner

@fidencio fidencio Awaiting requested review from fidencio

@nalind nalind Awaiting requested review from nalind

Assignees

@saschagrunert saschagrunert

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. kind/feature Categorizes issue or PR as related to a new feature. lgtm Indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@haircommander @saschagrunert @openshift-bot @openshift-merge-robot