This repository contains a user tailored container SELinux policies and the method for deploying these policies on Red Hat OpenShift Container Platform. These SELinux policies are required for the plugins in intel-device-plugins-for-kubernetes to deploy on Red Hat OpenShift Container Platform with proper SELinux permissions.
These policies creates a new domain called container_device_t and the device plugins run as that label and have all the necessary privileges. These policies are derived from the container-selinux project.
The policies are part of the container image and built using docker build
. To build such policies, install selinux-policy development package using below commands
$ sudo dnf -y selinux-policy-devel
$ make -f /usr/share/selinux/devel/Makefile
To deploy the policy on OpenShift Container Platform, run
$ oc apply -f https://raw.githubusercontent.com/intel/user-container-selinux/main/policy-deployment.yaml
user-container-selinux is under GNU GPL v2.0 license. See the LICENSE file for details.