mirror of
https://github.com/intel/intel-device-plugins-for-kubernetes.git
synced 2025-06-03 03:59:37 +00:00
add selinux labels for QAT
Signed-off-by: Manish Regmi <manish.regmi@intel.com>
This commit is contained in:
parent
97ac67f46f
commit
a888a91d2a
@ -17,6 +17,8 @@ spec:
|
||||
- name: intel-qat-plugin
|
||||
image: intel/intel-qat-plugin:devel
|
||||
securityContext:
|
||||
seLinuxOptions:
|
||||
type: "container_device_plugin_t"
|
||||
readOnlyRootFilesystem: true
|
||||
allowPrivilegeEscalation: false
|
||||
imagePullPolicy: IfNotPresent
|
||||
|
@ -222,6 +222,9 @@ func setInitContainer(dsSpec *v1.PodSpec, dpSpec devicepluginv1.QatDevicePluginS
|
||||
Value: strings.Join(enablingPfPciIDs, " "),
|
||||
}},
|
||||
SecurityContext: &v1.SecurityContext{
|
||||
SELinuxOptions: &v1.SELinuxOptions{
|
||||
Type: "container_device_plugin_init_t",
|
||||
},
|
||||
Privileged: &yes,
|
||||
ReadOnlyRootFilesystem: &yes,
|
||||
},
|
||||
|
@ -72,6 +72,9 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
|
||||
Image: devicePlugin.Spec.Image,
|
||||
ImagePullPolicy: "IfNotPresent",
|
||||
SecurityContext: &v1.SecurityContext{
|
||||
SELinuxOptions: &v1.SELinuxOptions{
|
||||
Type: "container_device_plugin_t",
|
||||
},
|
||||
ReadOnlyRootFilesystem: &yes,
|
||||
AllowPrivilegeEscalation: &no,
|
||||
},
|
||||
|
Loading…
Reference in New Issue
Block a user