SELinux support (#122)

* SELinux support Add support to the chart to set the SELinux context to enable a working system. Enable it by default on OpenShift clusters. Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]>
2023-12-07 11:02:06 -08:00
parent c017d82594
commit 13f6028ccd
4 changed files with 45 additions and 23 deletions
@@ -36,9 +36,31 @@ spec:
      {{- if .Values.priorityClassName }}
      priorityClassName: {{ .Values.priorityClassName }}
      {{- end }}
-      {{- with .Values.initContainers }}
+      {{- if or (gt (len .Values.initContainers) 0) (dig "openshift" false .Values.global) (dig "selinux" false .Values.global) .Values.selinux.enabled }}
      initContainers:
-        {{- toYaml . | nindent 8 }}
+      {{- if or (dig "openshift" false .Values.global) (dig "selinux" false .Values.global) .Values.selinux.enabled }}
+        - name: set-context
+          command:
+            - chcon
+            - '-Rvt'
+            - {{ .Values.selinux.context }}
+            - spire-agent-socket/
+          image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.selinux.image "global" .Values.global) }}
+          imagePullPolicy: {{ .Values.selinux.image.pullPolicy }}
+          securityContext:
+            capabilities:
+              drop:
+                - all
+            privileged: true
+          volumeMounts:
+            - name: spire-agent-socket-dir
+              mountPath: /spire-agent-socket
+          terminationMessagePolicy: File
+          terminationMessagePath: /dev/termination-log
+      {{- end }}
+      {{- if gt (len .Values.initContainers) 0 }}
+        {{- toYaml .Values.initContainers | nindent 8 }}
+      {{- end }}
      {{- end }}
      containers:
        # This is the container which runs the SPIFFE CSI driver.