Skip to content

Commit ef3f88a

Browse files
committed
Improve selinux docs
Signed-off-by: manuelbuil <mbuil@suse.com>
1 parent e32fcbc commit ef3f88a

File tree

2 files changed

+11
-8
lines changed

2 files changed

+11
-8
lines changed

docs/advanced.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -361,12 +361,12 @@ The [install script](./installation/configuration.md#configuration-with-install-
361361

362362
</TabItem>
363363

364-
<TabItem value="Manual Installation" default>
364+
<TabItem value="Manual Installation">
365365

366366
The necessary policies can be installed with the following commands:
367367
```bash
368368
yum install -y container-selinux selinux-policy-base
369-
yum install -y https://rpm.rancher.io/k3s/latest/common/centos/7/noarch/k3s-selinux-1.4-1.el7.noarch.rpm
369+
yum install -y https://rpm.rancher.io/k3s/latest/common/centos/9/noarch/k3s-selinux-1.6-1.el9.noarch.rpm
370370
```
371371

372372
To force the install script to log a warning rather than fail, you can set the following environment variable: `INSTALL_K3S_SELINUX_WARN=true`.
@@ -375,7 +375,7 @@ To force the install script to log a warning rather than fail, you can set the f
375375

376376
### Enabling SELinux Enforcement
377377

378-
To leverage SELinux, specify the `--selinux` flag when starting K3s servers and agents.
378+
To leverage SELinux, specify the `--selinux` flag when starting K3s servers and agents or setting the K3S_SELINUX=true environment variable.
379379

380380
This option can also be specified in the K3s [configuration file](./installation/configuration.md#configuration-file).
381381

docs/installation/airgap.md

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -103,16 +103,19 @@ When running the K3s script with the `INSTALL_K3S_SKIP_DOWNLOAD` environment var
103103

104104
#### SELinux RPM
105105

106-
If you intend to deploy K3s with SELinux enabled, you will need also install the appropriate k3s-selinux RPM on all nodes. The latest version of the RPM can be found [here](https://github.com/k3s-io/k3s-selinux/releases/latest). For example, on CentOS 8:
106+
If running on an air-gapped node with SELinux enabled, you must manually install the k3s-selinux RPM before installing K3s. This RPM includes the necessary SELinux policies for K3s to run properly. The latest version of the RPM can be found [here](https://github.com/k3s-io/k3s-selinux/releases/latest). For example, on CentOS 8:
107107

108108
```bash
109-
On internet accessible machine:
110-
curl -LO https://github.com/k3s-io/k3s-selinux/releases/download/v1.4.stable.1/k3s-selinux-1.4-1.el8.noarch.rpm
109+
# On internet accessible machine:
110+
curl -LO https://github.com/k3s-io/k3s-selinux/releases/download/v1.6.stable.1/k3s-selinux-1.6-1.el8.noarch.rpm
111111

112112
# Transfer RPM to air-gapped machine
113-
On air-gapped machine:
114-
sudo yum install ./k3s-selinux-1.4-1.el8.noarch.rpm
113+
sudo yum install ./k3s-selinux-1.6-1.el8.noarch.rpm
115114
```
115+
The k3s-selinux RPM installation requires the following dependencies to be available in the OS:
116+
* container-selinux
117+
* policycoreutils
118+
* selinux-policy
116119

117120
See the [SELinux](../advanced.md#selinux-support) section for more information.
118121

0 commit comments

Comments
 (0)