{"action":"closed","issue":{"url":"https://api.github.com/repos/openshift/origin/issues/15950","repository_url":"https://api.github.com/repos/openshift/origin","labels_url":"https://api.github.com/repos/openshift/origin/issues/15950/labels{/name}","comments_url":"https://api.github.com/repos/openshift/origin/issues/15950/comments","events_url":"https://api.github.com/repos/openshift/origin/issues/15950/events","html_url":"https://github.com/openshift/origin/issues/15950","id":252536147,"number":15950,"title":"Forced SELinux relabeling when mounting flexvolumes breaks flexvolumes that don't support SELinux e.g fuse","user":{"login":"AlbertoPeon","id":1299884,"avatar_url":"https://avatars0.githubusercontent.com/u/1299884?v=4","gravatar_id":"","url":"https://api.github.com/users/AlbertoPeon","html_url":"https://github.com/AlbertoPeon","followers_url":"https://api.github.com/users/AlbertoPeon/followers","following_url":"https://api.github.com/users/AlbertoPeon/following{/other_user}","gists_url":"https://api.github.com/users/AlbertoPeon/gists{/gist_id}","starred_url":"https://api.github.com/users/AlbertoPeon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AlbertoPeon/subscriptions","organizations_url":"https://api.github.com/users/AlbertoPeon/orgs","repos_url":"https://api.github.com/users/AlbertoPeon/repos","events_url":"https://api.github.com/users/AlbertoPeon/events{/privacy}","received_events_url":"https://api.github.com/users/AlbertoPeon/received_events","type":"User","site_admin":false},"labels":[{"id":210157112,"url":"https://api.github.com/repos/openshift/origin/labels/component/kubernetes","name":"component/kubernetes","color":"0052cc","default":false},{"id":210156418,"url":"https://api.github.com/repos/openshift/origin/labels/component/storage","name":"component/storage","color":"0052cc","default":false},{"id":118251699,"url":"https://api.github.com/repos/openshift/origin/labels/kind/bug","name":"kind/bug","color":"e11d21","default":false},{"id":858447969,"url":"https://api.github.com/repos/openshift/origin/labels/lifecycle/rotten","name":"lifecycle/rotten","color":"604460","default":false},{"id":210151819,"url":"https://api.github.com/repos/openshift/origin/labels/priority/P1","name":"priority/P1","color":"eb6420","default":false}],"state":"closed","locked":false,"assignee":{"login":"childsb","id":722782,"avatar_url":"https://avatars2.githubusercontent.com/u/722782?v=4","gravatar_id":"","url":"https://api.github.com/users/childsb","html_url":"https://github.com/childsb","followers_url":"https://api.github.com/users/childsb/followers","following_url":"https://api.github.com/users/childsb/following{/other_user}","gists_url":"https://api.github.com/users/childsb/gists{/gist_id}","starred_url":"https://api.github.com/users/childsb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/childsb/subscriptions","organizations_url":"https://api.github.com/users/childsb/orgs","repos_url":"https://api.github.com/users/childsb/repos","events_url":"https://api.github.com/users/childsb/events{/privacy}","received_events_url":"https://api.github.com/users/childsb/received_events","type":"User","site_admin":false},"assignees":[{"login":"childsb","id":722782,"avatar_url":"https://avatars2.githubusercontent.com/u/722782?v=4","gravatar_id":"","url":"https://api.github.com/users/childsb","html_url":"https://github.com/childsb","followers_url":"https://api.github.com/users/childsb/followers","following_url":"https://api.github.com/users/childsb/following{/other_user}","gists_url":"https://api.github.com/users/childsb/gists{/gist_id}","starred_url":"https://api.github.com/users/childsb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/childsb/subscriptions","organizations_url":"https://api.github.com/users/childsb/orgs","repos_url":"https://api.github.com/users/childsb/repos","events_url":"https://api.github.com/users/childsb/events{/privacy}","received_events_url":"https://api.github.com/users/childsb/received_events","type":"User","site_admin":false}],"milestone":null,"comments":5,"created_at":"2017-08-24T09:11:05Z","updated_at":"2018-04-23T23:29:45Z","closed_at":"2018-04-23T23:29:45Z","author_association":"NONE","body":"Since Kubernetes 1.6 on, all Flexvolume driver mounts force a SELinux relabeling (ref. https://github.com/openshift/origin/blob/release-3.6/vendor/k8s.io/kubernetes/pkg/volume/flexvolume/mounter-defaults.go#L55). This option is hardcoded and there is no way to override the default value.\r\n\r\nThis is very inconvenient as it's impossible to make Flexvolumes which don't support SELinux relabeling to work, for instance those using `fuse`. \r\n\r\nTrying to mount one of these volume results in:\r\n\r\n```\r\nAug 22 15:59:24 oonodetes001 origin-node[31102]: E0822 15:59:24.493079 31102 kuberuntime_manager.go:719] container start failed: RunContainerError: failed to start container \"1fa5454873a3bb27b3ad3b2a80751838222b96be8015a073932a5b5512d49\": Error response from daemon: {\"message\":\"SELinux relabeling of /var/lib/origin/openshift.local.volumes/pods/145432da-8742-11e7-a5c8-02163e00ax32/volumes/vendor~vol/pv-vol-test is not allowed: \\\"operation not supported\\\"\"}\r\n```\r\n\r\nIn our particular case, our users rely on a Flexvolume that will not work anymore, so we cannot safely upgrade from OpenShift 1.5 to 3.6.\r\n\r\nThere is a patch for the issue in Kubernetes 1.8 (ref. https://github.com/kubernetes/kubernetes/pull/50843), which allows to disable this setting in the `init` method of the flexvolume.\r\n\r\nCould it be backported to OpenShift 3.6. and/or 3.7\r\n\r\n##### Version\r\nThis affects Kubernetes 1.6 and 1.7 so OpenShift 3.6 and most likely 3.7\r\n"}}
{"actor":{"display_login":"openshift-ci-robot"}}