Graduate SELinuxMount to GA - #18779
Merged
Merged
Conversation
kubernetes-prow
Bot
added
cncf-cla: yes
kubernetes-prow
Bot
added
the
do-not-merge/work-in-progress
kubernetes-prow
Bot
added
size/XXL
kubernetes-prow
Bot
removed
the
do-not-merge/work-in-progress
Member
Author
|
/retest |
hakman
requested changes
Sep 9, 2026
|
|
||
| * The AWS EBS CSI driver addon no longer creates the `ebs-csi-controller-volumemodifier` Service. kOps does not deploy the `volume-modifier-for-k8s` sidecar that this Service selects, because the sidecar image is published only to a registry that kOps does not mirror. The Service has had no endpoints since kOps 1.36, and volume modification through the `ebs.csi.aws.com` annotations has been unavailable for the same period. This addon does not prune, so an existing cluster keeps the Service until you delete it with `kubectl delete service -n kube-system ebs-csi-controller-volumemodifier`. | ||
|
|
||
| * On AWS and GCP, kOps now configures the EBS and PD CSI drivers for SELinux mount support (`CSIDriver.spec.seLinuxMount: true`, plus the host mounts it needs) whenever `spec.containerd.selinuxEnabled` is set on the cluster. On a node with SELinux in enforcing mode, this lets the kubelet label eligible volumes with `-o context` at mount time instead of recursively relabeling every file, which speeds up pod startup for large volumes. The behavior is controlled by the `SELinuxMount` feature flag, which now defaults to on; set `KOPS_FEATURE_FLAGS=-SELinuxMount` to disable it as an escape hatch. Clusters that previously set `+SELinuxMount` without `spec.containerd.selinuxEnabled: true` will no longer get the SELinux mount bits — set `spec.containerd.selinuxEnabled: true` to keep them. |
Member
Author
There was a problem hiding this comment.
Moved to 1.38 release notes
Promote the SELinuxMount feature flag from opt-in to enabled-by-default. Instead of being gated only by the flag, SELinux mount support in the AWS EBS and GCP PD CSI drivers is now rendered when the cluster sets spec.containerd.selinuxEnabled: true. This avoids polluting CSI driver pods with SELinux hostPath mounts on clusters that don't use SELinux, while making the feature work out of the box on clusters that do. On SELinux-enforcing nodes, eligible volumes are then mounted with -o context instead of recursively relabeled, speeding up pod startup for large volumes. The SELinuxMount flag is kept as an escape hatch: set KOPS_FEATURE_FLAGS=-SELinuxMount to disable the feature unconditionally.
It will check that SELinux propagates where appropriate and CSI drivers are installed with SELinuxMount support.
jsafrane
force-pushed
the
selinux-ga
branch
from
September 11, 2026 12:02
4db9135 to
6778c67
Compare
kubernetes-prow
Bot
added
size/L
Member
|
/test pull-kops-aws-upgrade-k135-ko135-to-k137-kolatest-many-addons |
Member
|
Thanks @jsafrane, nice to see this finally happening! |
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: hakman The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
kubernetes-prow
Bot
added
the
approved
Member
|
/lgtm |
kubernetes-prow
Bot
added
the
lgtm
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promote the SELinuxMount feature flag from opt-in to enabled-by-default. Instead of being gated only by the flag, SELinux mount support in the AWS EBS and GCP PD CSI drivers is now rendered when the cluster sets spec.containerd.selinuxEnabled: true.
This avoids polluting CSI driver pods with SELinux hostPath mounts on clusters that don't use SELinux, while making the feature work out of the box on clusters that do. On SELinux-enforcing nodes, eligible volumes are then mounted with -o context instead of recursively relabeled, speeding up pod startup for large volumes.
The SELinuxMount flag is kept as an escape hatch: set KOPS_FEATURE_FLAGS=-SELinuxMount to disable the feature unconditionally.
Fixes: #18778