search

awslabs / amazon-eks-ami

Packer configuration for building a custom EKS AMI
https://awslabs.github.io/amazon-eks-ami/
MIT No Attribution
2.46k stars 1.15k forks source link

feat(al2023): install `container-selinux` for SELinux enforcing mode #2006

Open jihed opened 1 month ago

jihed commented 1 month ago

What happened: When enable SELINUX=enforcing mode on al2023. The nodeadm fails to run and the node couldn't join the cluster. I found that the EKS AMI is missing container-selinux rpm

What you expected to happen: The EKS AMI with all flavor have the all the rpm needed for SELINUX enforcing mode.

How to reproduce it (as minimally and precisely as possible): Deploy EKS cluster with node that have selinux with enforcing mode like in this: linux. Environment:

cartermckinnon commented 1 month ago

AL2023 does not use The SELinux "enforcing" mode by default, that's why this package is not installed. If you want to enable enforcing mode on your nodes, you would need to install the necessary dependencies. If you want to open a PR to add some of this to the AMI, feel free 👍

nmangalia commented 1 month ago

Thanks @jihed for opening this issue. Basically there is no AWS doc/guide which says that the package "container-selinux" must be installed if SELINUX is enabled in "Enforcing" mode.

In other word, the current AWS EKS AL2023 AMIs are not supporting SELINUX enforcing mode.

now, let's talk about just normal AL2023 base OS AMI. if any customer installs 'docker" with SELINUX enforcing mode, will it work? Since the problem is known to us, it is easy for us to fix it but if it is unknown to the customer who are using SELINUX enforcing mode (required by AL2023 CIS benchmark level 2), it will be a blocker.

In my opinion, to reduce the overall impact of current AL2023 AMI with SELINUX enforcing mode, we must have all the required package installed in the base OS AMI itself or we must say that if you are using SELINUX enforcing mode then these are the must packages.