cephfs: support selinux mount options

- mount host's /etc/selinux in node plugins
- process mount options in all code paths for cephfs volume options

Signed-off-by: Alexandre Lossent <alexandre.lossent@cern.ch>

charts/ceph-csi-cephfs/templates/nodeplugin-daemonset.yaml

@@ -112,6 +112,9 @@ spec:
               name: host-mount
             - mountPath: /sys
               name: host-sys
+            - mountPath: /etc/selinux
+              name: etc-selinux
+              readOnly: true
             - mountPath: /lib/modules
               name: lib-modules
               readOnly: true
@@ -167,6 +170,9 @@ spec:
         - name: host-sys
           hostPath:
             path: /sys
+        - name: etc-selinux
+          hostPath:
+            path: /etc/selinux
         - name: host-mount
           hostPath:
             path: /run/mount

charts/ceph-csi-cephfs/templates/nodeplugin-psp.yaml

@@ -38,6 +38,8 @@ spec:
       readOnly: false
     - pathPrefix: '/sys'
       readOnly: false
+    - pathPrefix: '/etc/selinux'
+      readOnly: true
     - pathPrefix: '/lib/modules'
       readOnly: true
     - pathPrefix: '{{ .Values.kubeletDir }}'

charts/ceph-csi-rbd/templates/nodeplugin-daemonset.yaml

@@ -106,6 +106,9 @@ spec:
               name: host-mount
             - mountPath: /sys
               name: host-sys
+            - mountPath: /etc/selinux
+              name: etc-selinux
+              readOnly: true
             - mountPath: /lib/modules
               name: lib-modules
               readOnly: true
@@ -175,6 +178,9 @@ spec:
         - name: host-sys
           hostPath:
             path: /sys
+        - name: etc-selinux
+          hostPath:
+            path: /etc/selinux
         - name: lib-modules
           hostPath:
             path: /lib/modules

charts/ceph-csi-rbd/templates/nodeplugin-psp.yaml

@@ -38,6 +38,8 @@ spec:
       readOnly: false
     - pathPrefix: '/sys'
       readOnly: false
+    - pathPrefix: '/etc/selinux'
+      readOnly: true
     - pathPrefix: '/lib/modules'
       readOnly: true
     - pathPrefix: '{{ .Values.kubeletDir }}'

deploy/cephfs/kubernetes/csi-cephfsplugin.yaml

@@ -84,6 +84,9 @@ spec:
               mountPropagation: "Bidirectional"
             - name: host-sys
               mountPath: /sys
+            - name: etc-selinux
+              mountPath: /etc/selinux
+              readOnly: true
             - name: lib-modules
               mountPath: /lib/modules
               readOnly: true
@@ -137,6 +140,9 @@ spec:
         - name: host-sys
           hostPath:
             path: /sys
+        - name: etc-selinux
+          hostPath:
+            path: /etc/selinux
         - name: lib-modules
           hostPath:
             path: /lib/modules

deploy/cephfs/kubernetes/csi-nodeplugin-psp.yaml

@@ -32,6 +32,8 @@ spec:
       readOnly: false
     - pathPrefix: '/sys'
       readOnly: false
+    - pathPrefix: '/etc/selinux'
+      readOnly: true
     - pathPrefix: '/lib/modules'
       readOnly: true
     - pathPrefix: '/var/lib/kubelet/pods'

deploy/rbd/kubernetes/csi-nodeplugin-psp.yaml

@@ -32,6 +32,8 @@ spec:
       readOnly: false
     - pathPrefix: '/sys'
       readOnly: false
+    - pathPrefix: '/etc/selinux'
+      readOnly: true
     - pathPrefix: '/lib/modules'
       readOnly: true
     - pathPrefix: '/var/lib/kubelet/pods'

deploy/rbd/kubernetes/csi-rbdplugin.yaml

@@ -93,6 +93,9 @@ spec:
               name: host-sys
             - mountPath: /run/mount
               name: host-mount
+            - mountPath: /etc/selinux
+              name: etc-selinux
+              readOnly: true
             - mountPath: /lib/modules
               name: lib-modules
               readOnly: true
@@ -153,6 +156,9 @@ spec:
         - name: host-sys
           hostPath:
             path: /sys
+        - name: etc-selinux
+          hostPath:
+            path: /etc/selinux
         - name: host-mount
           hostPath:
             path: /run/mount

internal/cephfs/volumeoptions.go

@@ -411,6 +411,14 @@ func newVolumeOptionsFromMonitorList(
 		}
 	}
 
+	if err = extractOptionalOption(&opts.KernelMountOptions, "kernelMountOptions", options); err != nil {
+		return nil, nil, err
+	}
+
+	if err = extractOptionalOption(&opts.FuseMountOptions, "fuseMountOptions", options); err != nil {
+		return nil, nil, err
+	}
+
 	if err = extractMounter(&opts.Mounter, options); err != nil {
 		return nil, nil, err
 	}