5.4.3.2. 仅修改具有挂载传统应用程序 PVC 的 pod 的部署配置的 SELinux 标签

使用 MustRunAs 和 seLinuxOptions 选项创建一个新的 scc，使用 openshift-storage 项目使用的 Multi Category Security(MCS)：

例 5.41. YAML 文件示例

cat << EOF >> scc.yaml
allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegeEscalation: true
allowPrivilegedContainer: false
allowedCapabilities: null
apiVersion: security.openshift.io/v1
defaultAddCapabilities: null
fsGroup:
  type: MustRunAs
groups:
- system:authenticated
kind: SecurityContextConstraints
metadata:
  annotations:
  name: restricted-pvselinux
priority: null
readOnlyRootFilesystem: false
requiredDropCapabilities:
- KILL
- MKNOD
- SETUID
- SETGID
runAsUser:
  type: MustRunAsRange
seLinuxContext:
  seLinuxOptions:
    level: s0:c26,c0
  type: MustRunAs
supplementalGroups:
  type: RunAsAny
users: []
volumes:
- configMap
- downwardAPI
- emptyDir
- persistentVolumeClaim
- projected
- secret
EOF

$ cat << EOF >> scc.yaml
allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegeEscalation: true
allowPrivilegedContainer: false
allowedCapabilities: null
apiVersion: security.openshift.io/v1
defaultAddCapabilities: null
fsGroup:
  type: MustRunAs
groups:
- system:authenticated
kind: SecurityContextConstraints
metadata:
  annotations:
  name: restricted-pvselinux
priority: null
readOnlyRootFilesystem: false
requiredDropCapabilities:
- KILL
- MKNOD
- SETUID
- SETGID
runAsUser:
  type: MustRunAsRange
seLinuxContext:
  seLinuxOptions:
    level: s0:c26,c0
  type: MustRunAs
supplementalGroups:
  type: RunAsAny
users: []
volumes:
- configMap
- downwardAPI
- emptyDir
- persistentVolumeClaim
- projected
- secret
EOF

Copy to Clipboard

Toggle word wrap

oc create -f scc.yaml

$ oc create -f scc.yaml

Copy to Clipboard

Toggle word wrap

为部署创建一个服务帐户，并将其添加到新创建的 scc 中。

创建服务帐户：
```
oc create serviceaccount <service_account_name>
```
```
$ oc create serviceaccount <service_account_name>
```
Copy to Clipboard Toggle word wrap
<service_account_name>
指定服务帐户的名称。
例 5.42. 示例

$ oc create serviceaccount testnamespacesa

Copy to Clipboard Toggle word wrap

将服务帐户添加到新创建的 scc 中：

oc adm policy add-scc-to-user restricted-pvselinux -z <service_account_name>

$ oc adm policy add-scc-to-user restricted-pvselinux -z <service_account_name>

Copy to Clipboard

Toggle word wrap

例 5.43. 示例

oc adm policy add-scc-to-user restricted-pvselinux -z testnamespacesa

$ oc adm policy add-scc-to-user restricted-pvselinux -z testnamespacesa

Copy to Clipboard

Toggle word wrap

对传统应用程序部署进行补丁，使其使用新创建的服务帐户。现在，这允许您在部署中指定 SELinux 标签：

oc patch dc/<pod_name> '{"spec":{"template":{"spec":{"serviceAccountName": "<service_account_name>"}}}}'

$ oc patch dc/<pod_name> '{"spec":{"template":{"spec":{"serviceAccountName": "<service_account_name>"}}}}'

Copy to Clipboard

Toggle word wrap

例 5.44. 示例

oc patch dc/cephfs-write-workload-generator-no-cache --patch '{"spec":{"template":{"spec":{"serviceAccountName": "testnamespacesa"}}}}'

$ oc patch dc/cephfs-write-workload-generator-no-cache --patch '{"spec":{"template":{"spec":{"serviceAccountName": "testnamespacesa"}}}}'

Copy to Clipboard

Toggle word wrap

编辑部署，以指定要在部署配置的 SELinux 标签中使用的安全上下文：

oc edit dc <pod_name> -n <application_namespace>

$ oc edit dc <pod_name> -n <application_namespace>

Copy to Clipboard

Toggle word wrap

添加以下行：

spec:
 template:
    metadata:
      securityContext:
        seLinuxOptions:
          Level: <security_context_value>

spec:
 template:
    metadata:
      securityContext:
        seLinuxOptions:
          Level: <security_context_value>

Copy to Clipboard

Toggle word wrap

<security_context_value>

当您执行命令以在 NSFS 共享内为 S3 创建专用文件夹时，可以在 legacy 应用 Pod 的 CephFS PV 和 PVC 上创建一个专用文件夹时，即可找到这个值。

例 5.45. 示例

oc edit dc cephfs-write-workload-generator-no-cache -n testnamespace

$ oc edit dc cephfs-write-workload-generator-no-cache -n testnamespace

Copy to Clipboard

Toggle word wrap

spec:
 template:
    metadata:
      securityContext:
        seLinuxOptions:
          level: s0:c26,c0

spec:
 template:
    metadata:
      securityContext:
        seLinuxOptions:
          level: s0:c26,c0

Copy to Clipboard

Toggle word wrap

确保正确在部署配置中的 SELinux 标签中使用安全上下文：

oc get dc <pod_name> -n <application_namespace> -o yaml | grep -A 2 securityContext

$ oc get dc <pod_name> -n <application_namespace> -o yaml | grep -A 2 securityContext

Copy to Clipboard

Toggle word wrap

例 5.46. 示例

oc get dc cephfs-write-workload-generator-no-cache -n testnamespace -o yaml | grep -A 2 securityContext

$ oc get dc cephfs-write-workload-generator-no-cache -n testnamespace -o yaml | grep -A 2 securityContext

Copy to Clipboard

Toggle word wrap

例 5.47. 输出示例

      securityContext:
        seLinuxOptions:
          level: s0:c26,c0

      securityContext:
        seLinuxOptions:
          level: s0:c26,c0

Copy to Clipboard

Toggle word wrap

旧应用程序重启并开始使用与 openshift-storage 命名空间相同的 SELinux 标签。

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links