github/intel-device-plugins-for-kubernetes
7
0
Fork 0
mirror of https://github.com/intel/intel-device-plugins-for-kubernetes.git synced 2025-06-03 03:59:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1479 from mregmi/main

Browse Source 
Add SELinux Labels for DSA and IAA
This commit is contained in:
Tuomas Katila 2023-07-21 09:14:08 +03:00 committed by GitHub
commit 432741e5e0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
8 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
deployments/dsa_plugin/base/intel-dsa-plugin.yaml
View File

@ -24,6 +24,8 @@ spec:
image: intel/intel-dsa-plugin:devel
imagePullPolicy: IfNotPresent
securityContext:
seLinuxOptions:
type: "container_device_plugin_t"
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
volumeMounts:

2
deployments/dsa_plugin/overlays/dsa_initcontainer/dsa_initcontainer.yaml
View File

@ -14,6 +14,8 @@ spec:
fieldPath: spec.nodeName
image: intel/intel-idxd-config-initcontainer:devel
securityContext:
seLinuxOptions:
type: "container_device_plugin_init_t"
readOnlyRootFilesystem: true
privileged: true
volumeMounts:

2
deployments/iaa_plugin/base/intel-iaa-plugin.yaml
View File

@ -24,6 +24,8 @@ spec:
image: intel/intel-iaa-plugin:devel
imagePullPolicy: IfNotPresent
securityContext:
seLinuxOptions:
type: "container_device_plugin_t"
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
volumeMounts:

2
deployments/iaa_plugin/overlays/iaa_initcontainer/iaa_initcontainer.yaml
View File

@ -16,6 +16,8 @@ spec:
value: "iaa"
image: intel/intel-idxd-config-initcontainer:devel
securityContext:
seLinuxOptions:
type: "container_device_plugin_init_t"
readOnlyRootFilesystem: true
privileged: true
volumeMounts:

3
pkg/controllers/dsa/controller.go
View File

@ -130,6 +130,9 @@ func addInitContainer(ds *apps.DaemonSet, dp *devicepluginv1.DsaDevicePlugin) {
},
},
SecurityContext: &v1.SecurityContext{
SELinuxOptions: &v1.SELinuxOptions{
Type: "container_device_plugin_init_t",
},
ReadOnlyRootFilesystem: &yes,
Privileged: &yes,
},

3
pkg/controllers/dsa/controller_test.go
View File

@ -79,6 +79,9 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
Image: devicePlugin.Spec.Image,
ImagePullPolicy: "IfNotPresent",
SecurityContext: &v1.SecurityContext{
SELinuxOptions: &v1.SELinuxOptions{
Type: "container_device_plugin_t",
},
ReadOnlyRootFilesystem: &yes,
AllowPrivilegeEscalation: &no,
},

3
pkg/controllers/iaa/controller.go
View File

@ -129,6 +129,9 @@ func addInitContainer(ds *apps.DaemonSet, dp *devicepluginv1.IaaDevicePlugin) {
},
},
SecurityContext: &v1.SecurityContext{
SELinuxOptions: &v1.SELinuxOptions{
Type: "container_device_plugin_init_t",
},
ReadOnlyRootFilesystem: &yes,
Privileged: &yes,
},

3
pkg/controllers/iaa/controller_test.go
View File

@ -79,6 +79,9 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
Image: devicePlugin.Spec.Image,
ImagePullPolicy: "IfNotPresent",
SecurityContext: &v1.SecurityContext{
SELinuxOptions: &v1.SELinuxOptions{
Type: "container_device_plugin_t",
},
ReadOnlyRootFilesystem: &yes,
AllowPrivilegeEscalation: &no,
},