WIP: STOR-2267: Run SELinux warning controller #834
Conversation
selinux-warning-controller is an optional controller in KCM that emits metrics + events about SELinux usage of persistent volumes in the cluster. Since most Kubernetes distros don't care about SELinux, this controller needs explicit opt-in on KCM cmdline. OCP needs the controller: - to explain to users why their pods may not be running. - to collect metrics about such promebatic pods, to emit alerts and telemetry. The controller is disabled by default in Kubernetes 1.32 (under SELinuxChangePolicy feature gate). Enhancement: https://github.com/kubernetes/enhancements/tree/master/keps/sig-storage/1710-selinux-relabeling
openshift-ci
bot
added
the
do-not-merge/work-in-progress
jsafrane
changed the title
openshift-ci-robot
added
the
jira/valid-reference
|
@jsafrane: This pull request references STOR-2267 which is a valid jira issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: jsafrane The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@jsafrane: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
selinux-warning-controller is an optional controller in KCM that emits metrics + events about SELinux usage of persistent volumes in the cluster.
Since most Kubernetes distros don't care about SELinux, this controller needs explicit opt-in on KCM cmdline.
OCP needs the controller:
The controller is disabled by default in Kubernetes 1.32 (under SELinuxChangePolicy feature gate).
Enhancement: https://github.com/kubernetes/enhancements/tree/master/keps/sig-storage/1710-selinux-relabeling
WIP: for manual testing