From e7b76482e2d2138ea02def61201a7baa2f981f72 Mon Sep 17 00:00:00 2001 From: Maksym Pavlenko Date: Fri, 30 Oct 2026 12:18:21 -0700 Subject: [PATCH] cri: warn when a sandbox controller returns an SELinux label CRI owns the pod SELinux label, so a label returned by the sandbox controller is ignored. Log a warning when it differs from the one CRI allocated. Signed-off-by: Maksym Pavlenko --- internal/cri/server/sandbox_run.go | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/internal/cri/server/sandbox_run.go b/internal/cri/server/sandbox_run.go index 2ab89169c1..1972888a7f 100644 --- a/internal/cri/server/sandbox_run.go +++ b/internal/cri/server/sandbox_run.go @@ -362,6 +362,15 @@ func (c *criService) RunPodSandbox(ctx context.Context, r *runtime.RunPodSandbox } } + // CRI owns the pod SELinux label; a label from the controller is ignored. + if l := ctrl.Labels["selinux_label"]; l != "" && l != sandbox.ProcessLabel { + log.G(ctx).WithFields(log.Fields{ + "sandbox": id, + "controller_label": l, + "selinux_label": sandbox.ProcessLabel, + }).Warn("ignoring the SELinux label returned by the sandbox controller, using the label allocated by CRI") + } + sandboxInfo.Labels = ctrl.Labels sandboxInfo.Spec = ctrl.Spec