[WIP] Selinux Mounts

Signed-off-by: Connor Catlett <[email protected]>
kubernetes-sigs · Dec 4, 2024 · 2acf2f6 · 2acf2f6
1 parent 39822b5
commit 2acf2f6
Show file tree

Hide file tree

Showing 2 changed files with 28 additions and 0 deletions.
diff --git a/charts/aws-ebs-csi-driver/templates/_node.tpl b/charts/aws-ebs-csi-driver/templates/_node.tpl
@@ -127,6 +127,10 @@ spec:
               mountPath: /csi
             - name: device-dir
               mountPath: /dev
+            - name: selinux-sysfs
+              mountPath: /sys/fs/selinux
+            - name: selinux-config
+              mountPath: /etc/selinux/config
           {{- with .Values.node.volumeMounts }}
           {{- toYaml . | nindent 12 }}
           {{- end }}
@@ -244,6 +248,16 @@ spec:
           hostPath:
             path: /dev
             type: Directory
+        - name: selinux-sysfs
+          hostPath:
+            path: /sys/fs/selinux
+            type: Directory
+            readOnly: true
+        - name: selinux-config
+          hostPath:
+            path: /etc/selinux/config
+            type: File
+            readOnly: true
         - name: probe-dir
           {{- if .Values.node.probeDirVolume }}
           {{- toYaml .Values.node.probeDirVolume | nindent 10 }}

diff --git a/deploy/kubernetes/base/node.yaml b/deploy/kubernetes/base/node.yaml
@@ -79,6 +79,10 @@ spec:
               mountPath: /csi
             - name: device-dir
               mountPath: /dev
+            - name: selinux-sysfs
+              mountPath: /sys/fs/selinux
+            - name: selinux-config
+              mountPath: /etc/selinux/config
           ports:
             - name: healthz
               containerPort: 9808
@@ -175,5 +179,15 @@ spec:
           hostPath:
             path: /dev
             type: Directory
+        - name: selinux-sysfs
+          hostPath:
+            path: /sys/fs/selinux
+            type: Directory
+            readOnly: true
+        - name: selinux-config
+          hostPath:
+            path: /etc/selinux/config
+            type: File
+            readOnly: true
         - name: probe-dir
           emptyDir: {}