Change virt-launcher SELinux type to spc_t
We have a problem to run unprivileged virt-launcher pod
because of SELinux, as short term solution I set spc_t
SELinux type on the pod.
I think as long term solution we need to provide, SELinux policy
for the libvirt that placed under container.
@@ -323,6 +323,9 @@ func (t *templateService) RenderLaunchManifest(vmi *v1.VirtualMachineInstance) (
Subdomain: vmi.Spec.Subdomain,
SecurityContext: &k8sv1.PodSecurityContext{
RunAsUser: &userId,
+ SELinuxOptions: &k8sv1.SELinuxOptions{
+ Type: "spc_t",
+ },
},
TerminationGracePeriodSeconds: &gracePeriodKillAfter,
RestartPolicy: k8sv1.RestartPolicyNever,
