Repository navigation
Require calico-selinux 1.1 on RHEL nodes - #3070
Conversation
✅ Deploy Preview for calico-docs-preview-next ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview succeeded!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify project configuration. |
hjiawei
changed the title
calico-selinux 1.0 does not let containers mmap files under /var/log/calico. The Fluent Bit log collector needs that for its tail DBs and buffer chunks, so with 1.0 the calico-fluent-bit pods crash-loop on SELinux-enforcing RHEL nodes. The install requirements now point at the 1.1 packages. The operator and Helm upgrade pages add a step to upgrade the package before upgrading Calico Enterprise. SELinux joins the Vale vocabulary.
9686a29 to
8b6e5fa
Compare
lwr20
left a comment
lwr20
left a comment
There was a problem hiding this comment.
LGTM. Can we hold the merge until the 1.1 RPMs are on downloads.tigera.io? The next docs are public, and right now those dnf install URLs return 403, so the requirements page would hand people a broken command in the meantime.
|
@hjiawei Thanks for this. LGTM. I will be moving all the upgrade notes to a separate page before the release, but let's go ahead and get this in in the meantime. @lwr20 The next docs are not actually published. Are you talking about the vNext preview? For what it's worth, I'm happy to merge now and leave the link verification for our prerelease testing. |
|
@ctauchen Yes, I meant the vNext preview, sorry. Merging now is fine. The 1.1 RPMs still 403, so the prerelease link check should catch it if they're not up by then. |
Product Version(s):
Calico Enterprise v3.24 (next-version docs only). The versioned
version-3.24-1andversion-3.24-2docs are left as they are.Issue:
None
Link to docs preview:
SME review:
DOCS review:
Additional information:
calico-selinux 1.0 does not let containers mmap files under
/var/log/calico. The Fluent Bit log collector in v3.24 needs that for its tail DBs and buffer chunks, so with 1.0 thecalico-fluent-bitpods crash-loop on SELinux-enforcing RHEL nodes. calico-selinux 1.1 adds the permission.ReqsSys.js)dnf installwith the 1.1 URL upgrades 1.0 in place.SELinux.OpenShift is not covered: there the log collector runs privileged, and RHCOS nodes do not use this package.
Validation: Vale on the changed pages reports nothing. I checked the
dnf installupgrade on Rocky 9 by installing 1.0, then a 1.1 build.AI assistance: Claude Code wrote the change; reviewed by the author.
Merge checklist: