[Documentation] SELinux

[davidnuzik]

K3s has limited SELinux support and we are working to improve this support. We expect to be at a point soon where we consider this complete. This issue is for tracking necessary changes when we consider SELinux to be stable and out of experimental state.. RKE2 documentation on SELinux will have precedence at this time, however we need to work on K3s docs on SELinux as soon as able after this.

More details to come. For now we're using this issue as a placeholder for this work that needs to be done.

[davidnuzik]

We need to document how to set up the YUM repo and the correct package to install for selinux policy/support. We need to explain that if you change the --data-dir you will need to manually re-label appropriately.

[ShylajaDevadiga]

We also need to document enabling selinux explicitly from with v1.19.1-rc1+k3s1 onwards using flag --selinux=true or using config file with SELinux is set to Enforcing mode

[davidnuzik]

I created #2247 to track the need to update docs to indicate the need for the --selinux flag. This issue may take a while longer before we can merge it in. We likely will stand by on this issue until a future v1.19.x release before we call SELinux stable.

I have updated the issue body of this issue to make it more clear this is for tracking selinux when it's out of experimental phase.

[catherineluse]

@ShylajaDevadiga can you please provide an example snippet from the config file in which the SELinux option is enabled? I think it might help to have it in the docs.

@davidnuzik what do you mean, manually re-label the data dir?

[ShylajaDevadiga]

@catherineluse To enable SELinux on k3s using config file

cat /etc/rancher/k3s/config.yaml
selinux: true

[catherineluse]

I have added the config file snippet to the docs PR.

[davidnuzik]

Regarding my statement

We need to document how to set up the YUM repo and the correct package to install for selinux policy/support. We need to explain that if you change the --data-dir you will need to manually re-label appropriately.

I filled this in during a meeting. I don't have context on it. @cjellick or @dweomer would need to explain.
cc: @catherineluse

[dweomer]

Regarding my statement

We need to document how to set up the YUM repo and the correct package to install for selinux policy/support. We need to explain that if you change the --data-dir you will need to manually re-label appropriately.

I filled this in during a meeting. I don't have context on it. @cjellick or @dweomer would need to explain.
cc: @catherineluse

I would go so far as to state that running with a custom --data-dir under SELinux is not supported. Users should not opt for this unless they know what they are doing. Point them to the containers/container-selinux and rancher/k3s-selinux repositories and let them know they will most likely have to write and install their own custom policy.

[catherineluse]

I've added the warning about the custom --data-dir to the SELinux docs PR. rancher/docs#2686 (comment)

[catherineluse]

Closing this issue because rancher/docs#2686 was merged