docs: add SELinux page for RHEL 8/9 standalone and private-node workers#2005
Draft
janekbaraniewski wants to merge 1 commit intoloft-sh:mainfrom
Draft
docs: add SELinux page for RHEL 8/9 standalone and private-node workers#2005janekbaraniewski wants to merge 1 commit intoloft-sh:mainfrom
janekbaraniewski wants to merge 1 commit intoloft-sh:mainfrom
Conversation
✅ Deploy Preview for vcluster-docs-site ready!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
janekbaraniewski
changed the title
Documents the `vcluster-selinux` RPM: how it works, the RHEL 9 support matrix, install/upgrade/uninstall flows (including --containerd-selinux, --selinux-rpm-url, --skip-selinux-rpm), verification commands, and troubleshooting for the common denial patterns. Also flips the "SELinux not supported" warning on both node-requirements pages to point at the new page, and adds `vcluster-selinux` + `rpm.vcluster.com` to the vale vocab so product-specific strings don't trip the Terms rule. Every command was exercised end-to-end on a fresh Rocky 9 VM in GCP (zero scoped AVCs on install, node Ready, uninstall cleans up). Closes DOC-713 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
janekbaraniewski
force-pushed
the
DOC-713/selinux-support
branch
from
c453aec to
7081003
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
vcluster/deploy/worker-nodes/private-nodes/security/selinux.mdx— the RHEL-on-SELinux story for vCluster Standalone and Private Node workers. Covers:vcluster-selinuxRPM does and the isolation boundary it establishes (vcluster_data_tfor host PKI/DB,container_runtime_tfor the vCluster binary,container_tblocked from both).rpm.vcluster.com,--containerd-selinuxfor tenant-pod MCS labels, offline / custom-mirror install via--selinux-rpm-url, image-bake +--skip-selinux-rpm, and fully manual yum-repo install.controlPlane.distro.k8s.version: v1.31.11. Fullvcluster.yamlsnippet in the page.dnf update, uninstall, and troubleshooting for the common AVC patterns (entrypoint fails to exec, missing.fcentry for a new binary, flannel fcontext override cleanup).Also removes the stale "SELinux currently not supported" warning on both node-requirements pages (
vcluster/deploy/worker-nodes/private-nodes/node-requirements.mdxandvcluster/deploy/control-plane/binary/node-requirements.mdx), updates the RHEL 8/9/10 rows to reflect reality, and tidies a handful of pre-existing vale warnings on those files. Addsvcluster-selinuxandrpm.vcluster.comto the Loft vale vocab.Scope: RHEL 8 and RHEL 9 ship the
vcluster-selinuxRPM. RHEL 10 isn't covered yet —loft-sh/vcluster-selinuxhaspolicy/el8andpolicy/el9trees but nopolicy/el10, so the installer exits non-zero on enforcing RHEL 10 and the table row points users atsetenforce 0.Test plan
npm run build— clean.vale vcluster/deploy/worker-nodes/private-nodes/security/selinux.mdx— 0 errors, 0 warnings.Ready,dnf removeunloads the module and removes the flannel fcontext override.setenforce 0+ rerun installer reaches nodeReady.Closes DOC-713