Skip to content

Document change to K3s SELinux option #2686

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
catherineluse merged 5 commits into from
Sep 16, 2020
Merged

Document change to K3s SELinux option #2686

Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
e37a34c
Document change to K3s SELinux option
catherineluse Sep 15, 2020
30ee90e
Say how to enable SELinux with K3s config file
catherineluse Sep 15, 2020
a7a0d50
Say that K3s will fail to start if both new and deprecated SELinux fl…
catherineluse Sep 16, 2020
74c65c5
Warn against using --disable-selinux in K3s v1.19.1+k3s1
catherineluse Sep 16, 2020
a8706f8
Warn against using a custom --data-dir for K3s with SELinux
catherineluse Sep 16, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions content/k3s/latest/en/advanced/_index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -314,6 +314,24 @@ rpm -i https://rpm.rancher.io/k3s-selinux-0.1.1-rc1.el7.noarch.rpm

To force the install script to log a warning rather than fail, you can set the following environment variable: `INSTALL_K3S_SELINUX_WARN=true`.

The way that SELinux enforcement is enabled or disabled depends on the K3s version.
Comment thread
catherineluse marked this conversation as resolved.
Outdated

{{% tabs %}}
{{% tab "K3s v1.19.1+k3s1" %}}

To leverage experimental SELinux, specify the `--selinux` flag when starting K3s servers and agents.

@ShylajaDevadiga ShylajaDevadiga Sep 15, 2020

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we explicitly say, not passing the flag would have selinux in disabled mode

@davidnuzik davidnuzik Sep 15, 2020

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm. In my opinion this is probably fine as it is.

@catherineluse catherineluse Sep 16, 2020

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll leave this sentence as is because @dweomer clarified it in his suggestion as well


This option can also be specified in the K3s [configuration file:]({{<baseurl>}}/k3s/latest/en/installation/install-options/#configuration-file)

```
selinux: true
```
{{%/tab%}}
{{% tab "K3s prior to v1.19.1+k3s1" %}}

@dweomer dweomer Sep 16, 2020

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As suggested, https://github.com/rancher/docs/pull/2686/files#r489578963, mentioning the --selinux flag without mentioning the conflict with --disable-selinux will likely lead to confusion and error. Additionally we should note for users that --disable-selinux is deprecated and will be either ignored or simply unrecognized, resulting in an error, in future minor releases.

@catherineluse catherineluse Sep 16, 2020

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added the info to the K3s v1.19+ tab:

The --disable-selinux option should not be used. It is deprecated and will be either ignored or will be unrecognized, resulting in an error, in future minor releases.

You can turn off SELinux enforcement in the embedded containerd by launching K3s with the `--disable-selinux` flag.

@ShylajaDevadiga ShylajaDevadiga Sep 15, 2020

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We do not have --disable-selinux flag instead use --selinux=false or skip selinux flag which does not enable selinux

@catherineluse catherineluse Sep 16, 2020

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This tab is saying that the --disable-selinux flag was used in older versions than v1.19.x. This tab won't show by default. is that OK?

@ShylajaDevadiga ShylajaDevadiga Sep 16, 2020

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sounds good @catherineluse Thanks


{{%/tab%}}
{{% /tabs %}}

Note that support for SELinux in containerd is still under development. Progress can be tracked in [this pull request](https://github.com/containerd/cri/pull/1246).