github/intel-device-plugins-for-kubernetes
7
0
Fork 0
mirror of https://github.com/intel/intel-device-plugins-for-kubernetes.git synced 2025-06-03 03:59:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

add selinux labels for QAT

Browse Source 
Signed-off-by: Manish Regmi <manish.regmi@intel.com>
This commit is contained in:
Manish Regmi 2022-06-01 10:13:11 -07:00
parent 97ac67f46f
commit a888a91d2a
3 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
deployments/qat_plugin/base/intel-qat-plugin.yaml
View File

@ -17,6 +17,8 @@ spec:
- name: intel-qat-plugin - name: intel-qat-plugin
image: intel/intel-qat-plugin:devel image: intel/intel-qat-plugin:devel
securityContext: securityContext:
seLinuxOptions:
type: "container_device_plugin_t"
readOnlyRootFilesystem: true readOnlyRootFilesystem: true
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent

3
pkg/controllers/qat/controller.go
View File

@ -222,6 +222,9 @@ func setInitContainer(dsSpec *v1.PodSpec, dpSpec devicepluginv1.QatDevicePluginS
Value: strings.Join(enablingPfPciIDs, " "), Value: strings.Join(enablingPfPciIDs, " "),
}}, }},
SecurityContext: &v1.SecurityContext{ SecurityContext: &v1.SecurityContext{
SELinuxOptions: &v1.SELinuxOptions{
Type: "container_device_plugin_init_t",
},
Privileged: &yes, Privileged: &yes,
ReadOnlyRootFilesystem: &yes, ReadOnlyRootFilesystem: &yes,
}, },

3
pkg/controllers/qat/controller_test.go
View File

@ -72,6 +72,9 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
Image: devicePlugin.Spec.Image, Image: devicePlugin.Spec.Image,
ImagePullPolicy: "IfNotPresent", ImagePullPolicy: "IfNotPresent",
SecurityContext: &v1.SecurityContext{ SecurityContext: &v1.SecurityContext{
SELinuxOptions: &v1.SELinuxOptions{
Type: "container_device_plugin_t",
},
ReadOnlyRootFilesystem: &yes, ReadOnlyRootFilesystem: &yes,
AllowPrivilegeEscalation: &no, AllowPrivilegeEscalation: &no,
}, },