SELinux Volume Label Changes goes GA (and likely implications in v1.37)
Kubernetes v1.37 plans to enable the SELinuxMount feature gate by default, which improves volume setup speed. This change might break applications relying on the older recursive relabeling method, especially those sharing volumes between privileged and unprivileged pods. The article encourages auditing clusters in v1.36 to identify and address potential conflicts related to SELinux. When SELinux is enabled, the kubelet applies SELinux labels to volumes for access control, and the new approach uses mount options for faster relabeling. The SELinuxChangePolicy field and the Recursive option were created to allow opting out of this performance acceleration method. If the conditions are met, the kubelet can now mount volumes directly with the appropriate SELinux label, eliminating the need for recursive relabeling. The selinux-warning-controller identifies conflicting Pods that might break with the new configuration, emitting events and metrics. Using the provided metrics, cluster administrators can detect potential issues and make appropriate adjustments. The recommended upgrade path includes enabling the controller, addressing conflicts, and then upgrading to a version with SELinuxMount enabled while monitoring for errors. Administrators can use various methods to enforce the opt-out for specific Pods. The new behavior allows faster performance but modifies sharing volumes among different pods.
SELinuxChangePolicyfield and theRecursiveoption were created to allow opting out of this performance acceleration method. If the conditions are met, the kubelet can now mount volumes directly with the appropriate SELinux label, eliminating the need for recursive relabeling. Theselinux-warning-controlleridentifies conflicting Pods that might break with the new configuration, emitting events and metrics. Using the provided metrics, cluster administrators can detect potential issues and make appropriate adjustments. The recommended upgrade path includes enabling the controller, addressing conflicts, and then upgrading to a version with SELinuxMount enabled while monitoring for errors. Administrators can use various methods to enforce the opt-out for specific Pods. The new behavior allows faster performance but modifies sharing volumes among different pods.