We are running Kubernetes with SELinux enabled. We would like to use serviceAccounts. When I disable SELinux containers can read the secrets, as expected.
But, when I enable SELinux we cannot read the secrets inside the container. For example:
localhost$ kubectl exec -it my-pod bash
my-pod$ ls /var/run/secrets/kubernetes.io/serviceaccount/
token
my-pod$ cat /var/run/secrets/kubernetes.io/serviceaccount/token
Permission denied
What is the recommended way to use serviceAccounts with SELinux?
Thanks, Andrej
You probably need to run the following command to set the SELinux context correctly in the volumes directory. I have an open issue to make this happen automatically in the future:
sudo chcon -Rt svirt_sandbox_file_t /var/lib/kubeletHope that helps.
There is an selinux policy rule for it (in Fedora 23 at least) but unfortunately it has a typo.
semanage fcontext -l | grep /var/lib/kub
/var/lib/kublet(/.*)? all files system_u:object_r:docker_var_lib_t:s0Should be "kubelet". I opened a bug here.