4.7. Checking the pods for mismatch

Procedure

1. List the mount point within the first pod by running the following command:

   $ oc get pods -n <pod_name_a> -ojsonpath='{.spec.containers[].volumeMounts[].mountPath}' 

   1

   1

   Replace <pod_name_a> with the name of the first pod.

   Example output

   /files /var/run/secrets/kubernetes.io/serviceaccount

2. List the mount point within the second pod by running the following command:

   $ oc get pods -n <pod_name_b> -ojsonpath='{.spec.containers[].volumeMounts[].mountPath}' 

   1

   1

   Replace <pod_name_b> with the name of the second pod.

   Example output

   /files /var/run/secrets/kubernetes.io/serviceaccount

3. Check the context and permissions inside the first pod by running the following command:

   $ oc rsh <pod_name_a> ls -lZah <pvc_mountpoint> 

   1

   1

   Replace <pod_name_a> with the name of the first pod and replace <pvc_mountpoint> with the mount point within the first pod.

   Example output

   total 12K
   dr-xr-xr-x.   1 root root system_u:object_r:container_file_t:s0:c398,c806   40 Feb 17 13:36 .
   dr-xr-xr-x.   1 root root system_u:object_r:container_file_t:s0:c398,c806   40 Feb 17 13:36 ..
   [...]

4. Check the context and permissions inside the second pod by running the following command:

   $ oc rsh <pod_name_b> ls -lZah <pvc_mountpoint> 

   1

   1

   Replace <pod_name_b> with the name of the second pod and replace <pvc_mountpoint> with the mount point within the second pod.

   Example output

   total 12K
   dr-xr-xr-x.   1 root root system_u:object_r:container_file_t:s0:c15,c25   40 Feb 17 13:34 .
   dr-xr-xr-x.   1 root root system_u:object_r:container_file_t:s0:c15,c25   40 Feb 17 13:34 ..
   [...]

5. Compare both the outputs to check if there is a mismatch of SELinux context.