summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorOpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com>2021-11-22 21:52:31 +0100
committerGitHub <noreply@github.com>2021-11-22 21:52:31 +0100
commit0b7c132d9f42a00e31eb8dc5133946f83572a418 (patch)
treeff5362e963a4468fb215bf59d7a4caf9fad76bb4
parented83ef2517ba4d6a0c7659206fe3a2faa0bdf547 (diff)
parenta8b3c67b974bd1b55a80188826e2c7ca983a9d95 (diff)
downloadpodman-0b7c132d9f42a00e31eb8dc5133946f83572a418.tar.gz
podman-0b7c132d9f42a00e31eb8dc5133946f83572a418.tar.bz2
podman-0b7c132d9f42a00e31eb8dc5133946f83572a418.zip
Merge pull request #12301 from umohnani8/table
Add note about volume with unprivileged container
-rw-r--r--docs/source/markdown/podman-generate-kube.1.md6
-rw-r--r--pkg/domain/infra/abi/generate.go8
2 files changed, 14 insertions, 0 deletions
diff --git a/docs/source/markdown/podman-generate-kube.1.md b/docs/source/markdown/podman-generate-kube.1.md
index 41545455e..3586341a9 100644
--- a/docs/source/markdown/podman-generate-kube.1.md
+++ b/docs/source/markdown/podman-generate-kube.1.md
@@ -19,6 +19,12 @@ Potential name conflicts between volumes are avoided by using a standard naming
Note that if an init container is created with type `once` and the pod has been started, the init container will not show up in the generated kube YAML as `once` type init containers are deleted after they are run. If the pod has only been created and not started, it will be in the generated kube YAML.
Init containers created with type `always` will always be generated in the kube YAML as they are never deleted, even after running to completion.
+*Note*: When using volumes and generating a Kubernetes YAML for an unprivileged and rootless podman container on an **SELinux enabled system**, one of the following options must be completed:
+ * Add the "privileged: true" option to the pod spec
+ * Add `type: spc_t` under the `securityContext` `seLinuxOptions` in the pod spec
+ * Relabel the volume via the CLI command `chcon -t container_file_t context -R <directory>`
+Once completed, the correct permissions will be in place to access the volume when the pod/container is created in a Kubernetes cluster.
+
Note that the generated Kubernetes YAML file can be used to re-run the deployment via podman-play-kube(1).
## OPTIONS
diff --git a/pkg/domain/infra/abi/generate.go b/pkg/domain/infra/abi/generate.go
index a4d6bcf86..0defa1923 100644
--- a/pkg/domain/infra/abi/generate.go
+++ b/pkg/domain/infra/abi/generate.go
@@ -124,6 +124,14 @@ func (ic *ContainerEngine) GenerateKube(ctx context.Context, nameOrIDs []string,
if err != nil {
return nil, err
}
+ if len(po.Spec.Volumes) != 0 {
+ warning := `
+# NOTE: If you generated this yaml from an unprivileged and rootless podman container on an SELinux
+# enabled system, check the podman generate kube man page for steps to follow to ensure that your pod/container
+# has the right permissions to access the volumes added.
+`
+ content = append(content, []byte(warning))
+ }
b, err := generateKubeYAML(libpod.ConvertV1PodToYAMLPod(po))
if err != nil {
return nil, err