Avoid setting SELinuxOptions on virt-launcher when no type is specified
Setting SELinuxOptions to anything, including "{}", has implications.
It notably disables automatic relabelling of overlay2 mounts.
Avoid setting SELinuxOptions when no SELinux type is specified.
@@ -983,12 +983,6 @@ func (t *templateService) RenderLaunchManifest(vmi *v1.VirtualMachineInstance) (
annotationsList[ISTIO_KUBEVIRT_ANNOTATION] = "k6t-eth0"
}
- // If an SELinux type was specified, use that--otherwise don't set an SELinux type
- selinuxOptions := k8sv1.SELinuxOptions{}
- if t.clusterConfig.GetSELinuxLauncherType() != virtconfig.DefaultSELinuxLauncherType {
- selinuxOptions.Type = t.clusterConfig.GetSELinuxLauncherType()
- }
-
// TODO use constants for podLabels
pod := k8sv1.Pod{
ObjectMeta: metav1.ObjectMeta{
@@ -1004,7 +998,6 @@ func (t *templateService) RenderLaunchManifest(vmi *v1.VirtualMachineInstance) (
Subdomain: vmi.Spec.Subdomain,
SecurityContext: &k8sv1.PodSecurityContext{
RunAsUser: &userId,
- SELinuxOptions: &selinuxOptions,
FSGroup: &t.launcherSubGid,
},
TerminationGracePeriodSeconds: &gracePeriodKillAfter,
@@ -1018,6 +1011,12 @@ func (t *templateService) RenderLaunchManifest(vmi *v1.VirtualMachineInstance) (
},
}
+ // If an SELinux type was specified, use that--otherwise don't set an SELinux type
+ selinuxType := t.clusterConfig.GetSELinuxLauncherType()
+ if selinuxType != virtconfig.DefaultSELinuxLauncherType {
+ pod.Spec.SecurityContext.SELinuxOptions = &k8sv1.SELinuxOptions{Type: selinuxType}
+ }
+
if vmi.Spec.PriorityClassName != "" {
pod.Spec.PriorityClassName = vmi.Spec.PriorityClassName
}
