kubeadm: bump versions #297
Conversation
Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
main change is that flannel CNI plugin is no more provided by CNI plugins. Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
this is required since recent Flannel installs its CNI by copying from container to host system. without the right label on `/opt/cni` the copy fails with SELinux in enforcing mode because the label does not match. Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
There was a problem hiding this comment.
The change itself is good, but I wonder about /usr/bin/chcon -R /opt/cni -t svirt_lxc_file_t: is this likely something users might also need to set when they deploy with kubeadm? If so then we should add it to our selinux docs (if we have some, otherise let's start some :) )
|
@jepio - thanks for the review ! There is a SELinux doc (a bit outdated but not on the commands: https://www.flatcar.org/docs/latest/setup/security/selinux/).
I would say "Yes" under these two conditions:
I opened a GH issue to track that: flatcar/Flatcar#635, this is something we should fix in the OS. The issue also mentions the mitigation, so I'm not sure it requires a dedicated documentation. What do you think ? |
|
Then atleast link the issue from the limitations section? |
|
@jepio done in: flatcar-archive/flatcar-docs#212. Merging this PR. |
in this PR, we officially bump Kubernetes tested versions. From what I understood, Kubernetes was already pulling stable version for the images, so it's only an update of the binaries (
kubeadm,kubelet, etc.).CNI version has been upgraded to 1.0.1 - since 1.0.0 Flannel plugin has been moved to its own repository and it's being installed by an init-container in the
kube-flannel.ymlplugin.This leads to an issue when trying to copy CNI plugin from the container to
/opt/cnibecause from a SELinux PoV labels are mismatching between hosts and container and this can be added to Flatcar virt policy in a second time. (see also: flatcar/Flatcar#635)The latest commit
kubeadm/template: update /opt/cni SELinux label typecan be dropped once the patch has been applied on every channel.Testing done
kubeadm.v1.23.4.flannel.basechangelog/directory (user-facing change, bug fix, security fix, update)