diff --git a/.github/styles/config/vocabularies/CalicoTerminology/accept.txt b/.github/styles/config/vocabularies/CalicoTerminology/accept.txt index da458feea5..73dc2c95db 100644 --- a/.github/styles/config/vocabularies/CalicoTerminology/accept.txt +++ b/.github/styles/config/vocabularies/CalicoTerminology/accept.txt @@ -162,3 +162,4 @@ coreRuleSet defaultAction enforcementMode SecLang +SELinux diff --git a/calico-enterprise/_includes/components/ReqsSys.js b/calico-enterprise/_includes/components/ReqsSys.js index cbfdd87442..c379fb3da3 100644 --- a/calico-enterprise/_includes/components/ReqsSys.js +++ b/calico-enterprise/_includes/components/ReqsSys.js @@ -58,13 +58,13 @@ function NodeRequirementsEnt(props) {
  • If your node has RHEL 8 installed, then run the following command:

    - {`dnf install https://downloads.tigera.io/ee/archives/calico-selinux-1.0-1.el8.noarch.rpm`} + {`dnf install https://downloads.tigera.io/ee/archives/calico-selinux-1.1-1.el8.noarch.rpm`}
  • If your node has RHEL 9 installed, then run the following command:

    - {`dnf install https://downloads.tigera.io/ee/archives/calico-selinux-1.0-1.el9.noarch.rpm`} + {`dnf install https://downloads.tigera.io/ee/archives/calico-selinux-1.1-1.el9.noarch.rpm`}
  • diff --git a/calico-enterprise/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx b/calico-enterprise/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx index 242803cc73..2b1d468570 100644 --- a/calico-enterprise/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx +++ b/calico-enterprise/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx @@ -50,6 +50,22 @@ If you manage $[prodname] resources with GitOps tooling, remove the Compliance r If you receive an error indicating the resource or resource type does not exist, Compliance was not installed in your cluster. You can safely ignore the error and proceed. +### RHEL nodes with SELinux + +If you installed the `calico-selinux` policy package on RHEL nodes, upgrade it to version 1.1 on each of those nodes before you upgrade $[prodname]. With version 1.0, SELinux stops the log collector from mapping its files under `/var/log/calico`, and the `calico-fluent-bit` pods crash-loop. To check whether a node has the package, run `rpm -q calico-selinux`. + +On RHEL 8 nodes, run: + +```bash +dnf install https://downloads.tigera.io/ee/archives/calico-selinux-1.1-1.el8.noarch.rpm +``` + +On RHEL 9 nodes, run: + +```bash +dnf install https://downloads.tigera.io/ee/archives/calico-selinux-1.1-1.el9.noarch.rpm +``` + ### Upgrade OwnerReferences If you do not use OwnerReferences on resources in the projectcalico.org/v3 API group, you can skip this section. diff --git a/calico-enterprise/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/operator.mdx b/calico-enterprise/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/operator.mdx index 936609fa08..2d9b910d2a 100644 --- a/calico-enterprise/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/operator.mdx +++ b/calico-enterprise/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/operator.mdx @@ -57,6 +57,22 @@ If you manage $[prodname] resources with GitOps tooling, remove the Compliance r If you receive an error indicating the resource or resource type does not exist, Compliance was not installed in your cluster. You can safely ignore the error and proceed. +### RHEL nodes with SELinux + +If you installed the `calico-selinux` policy package on RHEL nodes, upgrade it to version 1.1 on each of those nodes before you upgrade $[prodname]. With version 1.0, SELinux stops the log collector from mapping its files under `/var/log/calico`, and the `calico-fluent-bit` pods crash-loop. To check whether a node has the package, run `rpm -q calico-selinux`. + +On RHEL 8 nodes, run: + +```bash +dnf install https://downloads.tigera.io/ee/archives/calico-selinux-1.1-1.el8.noarch.rpm +``` + +On RHEL 9 nodes, run: + +```bash +dnf install https://downloads.tigera.io/ee/archives/calico-selinux-1.1-1.el9.noarch.rpm +``` + ### Upgrade OwnerReferences If you do not use OwnerReferences on resources in the projectcalico.org/v3 API group, you can skip this section.