add selinux labels for GPU plugins

This commit is contained in:
Manish Regmi 2022-09-01 11:29:09 -07:00 committed by Chaitanya
parent 399c1dd232
commit 22e9d5f882
3 changed files with 10 additions and 0 deletions

View File

@ -18,6 +18,8 @@ spec:
image: intel/intel-gpu-initcontainer:devel image: intel/intel-gpu-initcontainer:devel
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
securityContext: securityContext:
seLinuxOptions:
type: "container_device_plugin_init_t"
readOnlyRootFilesystem: true readOnlyRootFilesystem: true
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
volumeMounts: volumeMounts:
@ -33,6 +35,8 @@ spec:
image: intel/intel-gpu-plugin:devel image: intel/intel-gpu-plugin:devel
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
securityContext: securityContext:
seLinuxOptions:
type: "container_device_plugin_t"
readOnlyRootFilesystem: true readOnlyRootFilesystem: true
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
volumeMounts: volumeMounts:

View File

@ -196,6 +196,9 @@ func setInitContainer(spec *v1.PodSpec, imageName string) {
ImagePullPolicy: "IfNotPresent", ImagePullPolicy: "IfNotPresent",
Name: "intel-gpu-initcontainer", Name: "intel-gpu-initcontainer",
SecurityContext: &v1.SecurityContext{ SecurityContext: &v1.SecurityContext{
SELinuxOptions: &v1.SELinuxOptions{
Type: "container_device_plugin_init_t",
},
ReadOnlyRootFilesystem: &yes, ReadOnlyRootFilesystem: &yes,
}, },
VolumeMounts: []v1.VolumeMount{ VolumeMounts: []v1.VolumeMount{

View File

@ -79,6 +79,9 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
Image: devicePlugin.Spec.Image, Image: devicePlugin.Spec.Image,
ImagePullPolicy: "IfNotPresent", ImagePullPolicy: "IfNotPresent",
SecurityContext: &v1.SecurityContext{ SecurityContext: &v1.SecurityContext{
SELinuxOptions: &v1.SELinuxOptions{
Type: "container_device_plugin_t",
},
ReadOnlyRootFilesystem: &yes, ReadOnlyRootFilesystem: &yes,
AllowPrivilegeEscalation: &no, AllowPrivilegeEscalation: &no,
}, },