Red Hat build of MicroShift

Verifying pods after resolving a mismatch

To confirm that the mismatch is resolved, verify the security context constraint (SCC) and the SELinux label of the pods. Checking these settings ensures that your workloads are functioning with the correct security configurations.

Procedure

Verify that the same SCC is assigned to the first pod by running the following command:
```
$ oc describe pod <pod_name_a> |grep -i scc
```
- Replace <pod_name_a> with the name of the first pod.
  Example output
  openshift.io/scc: restricted
Verify that the same SCC is assigned to first second pod by running the following command:
```
$ oc describe pod <pod_name_b> |grep -i scc
```
- Replace <pod_name_b> with the name of the second pod.
  Example output
  openshift.io/scc: restricted

Verify that the same SELinux label is applied to first pod by running the following command:

$ oc exec <pod_name_a> -- ls -laZ <pvc_mountpoint>

Replace <pod_name_a> with the name of the first pod.

Replace <pvc_mountpoint> with the mount point within the first pod.

Example output

total 4
drwxrwsrwx. 2 root       1000670000 system_u:object_r:container_file_t:s0:c10,c26 19 Aug 29 18:17 .
dr-xr-xr-x. 1 root       root       system_u:object_r:container_file_t:s0:c10,c26 61 Aug 29 18:16 ..
-rw-rw-rw-. 1 1000670000 1000670000 system_u:object_r:container_file_t:s0:c10,c26 29 Aug 29 18:17 test1
[...]

Verify that the same SELinux label is applied to second pod by running the following command:

$ oc exec <pod_name_b> -- ls -laZ <pvc_mountpoint>

Replace <pod_name_b> with the name of the second pod.

Replace <pvc_mountpoint> with the mount point within the second pod.

Example output

total 4
drwxrwsrwx. 2 root       1000670000 system_u:object_r:container_file_t:s0:c10,c26 19 Aug 29 18:17 .
dr-xr-xr-x. 1 root       root       system_u:object_r:container_file_t:s0:c10,c26 61 Aug 29 18:16 ..
-rw-rw-rw-. 1 1000670000 1000670000 system_u:object_r:container_file_t:s0:c10,c26 29 Aug 29 18:17 test1
[...]