public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 04:28:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: update rancher-selinux docs for v0.9 across versions

Browse Source
This commit is contained in:
copilot-swe-agent[bot]
2026-05-28 08:50:34 +00:00
committed by GitHub
parent be0202bab4
commit be9dc30647
5 changed files with 150 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md
+30 -2
View File
@@ -8,6 +8,12 @@ title: About rancher-selinux
To allow Rancher to work with SELinux, some functionality has to be manually enabled for the SELinux nodes. To help with that, Rancher provides an SELinux RPM.
:::tip Why SELinux?
By assigning a dedicated SELinux type to each container, we ensure that containers are limited to their minimal needs and cannot pivot to other resources if compromised.
:::
The `rancher-selinux` RPM contains a set of SELinux policies designed to grant the necessary privileges to various Rancher components running on Linux systems with SELinux enabled.
The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/rancher-selinux)
@@ -16,7 +22,7 @@ The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/ra
:::note Requirement:
The `rancher-selinux` RPM was tested on openSUSE Tumbleweed and RHEL-based distributions including Centos/RockyLinux 8 and 9.
The `rancher-selinux` RPM was tested on openSUSE MicroOS, Fedora 42, and RHEL-based distributions including CentOS/RockyLinux 8, 9, and 10.
:::
@@ -50,6 +56,19 @@ gpgkey=https://rpm.rancher.io/public.key
EOF
```
In order to use the RPM repository, on a CentOS 10 or RHEL 10 system, run the following bash snippet:
```
# cat << EOF > /etc/yum.repos.d/rancher.repo
[rancher]
name=Rancher
baseurl=https://rpm.rancher.io/rancher/production/centos/10/noarch
enabled=1
gpgcheck=1
gpgkey=https://rpm.rancher.io/public.key
EOF
```
### 2. Installing the RPM
Install the RPM:
@@ -62,10 +81,19 @@ yum -y install rancher-selinux
:::note Requirement:
Logging v2 and Monitoring v2 were tested with SELinux on RHEL/CentOS 8, 9, and Tumbleweed.
Logging v2 and Monitoring v2 were tested with SELinux on RHEL/CentOS 8, 9, 10, and Tumbleweed.
:::
Applications do not automatically work once the `rancher-selinux` RPM is installed on the host. They need to be configured to run in an allowed SELinux container domain provided by the RPM.
To configure the `rancher-logging` or the `rancher-monitoring` chart to be SELinux aware, change `global.seLinux.enabled` to true in the `values.yaml` when installing the charts.
## Rancher AI SELinux Policies
Starting with `rancher-selinux` v0.9, SELinux policies are included for Rancher AI components:
- **rancher-ai-agent** — runs under the `rancher_aiagent_container_t` SELinux domain
- **rancher-ai-mcp** — runs under the `rancher_aimcp_container_t` SELinux domain
These policies are supported on all platforms: EL9, EL10, Fedora 42, and MicroOS.
versioned_docs/version-2.10/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md
+30 -2
View File
@@ -8,6 +8,12 @@ title: About rancher-selinux
To allow Rancher to work with SELinux, some functionality has to be manually enabled for the SELinux nodes. To help with that, Rancher provides an SELinux RPM.
:::tip Why SELinux?
By assigning a dedicated SELinux type to each container, we ensure that containers are limited to their minimal needs and cannot pivot to other resources if compromised.
:::
The `rancher-selinux` RPM contains a set of SELinux policies designed to grant the necessary privileges to various Rancher components running on Linux systems with SELinux enabled.
The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/rancher-selinux)
@@ -16,7 +22,7 @@ The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/ra
:::note Requirement:
The rancher-selinux RPM was tested with CentOS 7, 8 and 9.
The `rancher-selinux` RPM was tested with CentOS 7, 8, 9, and 10.
:::
@@ -63,6 +69,19 @@ gpgkey=https://rpm.rancher.io/public.key
EOF
```
In order to use the RPM repository, on a CentOS 10 or RHEL 10 system, run the following bash snippet:
```
# cat << EOF > /etc/yum.repos.d/rancher.repo
[rancher]
name=Rancher
baseurl=https://rpm.rancher.io/rancher/production/centos/10/noarch
enabled=1
gpgcheck=1
gpgkey=https://rpm.rancher.io/public.key
EOF
```
### 2. Installing the RPM
Install the RPM:
@@ -75,10 +94,19 @@ yum -y install rancher-selinux
:::note Requirement:
Logging v2 was tested with SELinux on RHEL/CentOS 7, 8 and 9.
Logging v2 was tested with SELinux on RHEL/CentOS 7, 8, 9, and 10.
:::
Applications do not automatically work once the `rancher-selinux` RPM is installed on the host. They need to be configured to run in an allowed SELinux container domain provided by the RPM.
To configure the `rancher-logging` chart to be SELinux aware, change `global.seLinux.enabled` to true in the `values.yaml` when installing the chart.
## Rancher AI SELinux Policies
Starting with `rancher-selinux` v0.9, SELinux policies are included for Rancher AI components:
- **rancher-ai-agent** — runs under the `rancher_aiagent_container_t` SELinux domain
- **rancher-ai-mcp** — runs under the `rancher_aimcp_container_t` SELinux domain
These policies are supported on all platforms: EL9, EL10, Fedora 42, and MicroOS.
versioned_docs/version-2.11/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md
+30 -2
View File
@@ -8,6 +8,12 @@ title: About rancher-selinux
To allow Rancher to work with SELinux, some functionality has to be manually enabled for the SELinux nodes. To help with that, Rancher provides an SELinux RPM.
:::tip Why SELinux?
By assigning a dedicated SELinux type to each container, we ensure that containers are limited to their minimal needs and cannot pivot to other resources if compromised.
:::
The `rancher-selinux` RPM contains a set of SELinux policies designed to grant the necessary privileges to various Rancher components running on Linux systems with SELinux enabled.
The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/rancher-selinux)
@@ -16,7 +22,7 @@ The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/ra
:::note Requirement:
The rancher-selinux RPM was tested with CentOS 7, 8 and 9.
The `rancher-selinux` RPM was tested with CentOS 7, 8, 9, and 10.
:::
@@ -63,6 +69,19 @@ gpgkey=https://rpm.rancher.io/public.key
EOF
```
In order to use the RPM repository, on a CentOS 10 or RHEL 10 system, run the following bash snippet:
```
# cat << EOF > /etc/yum.repos.d/rancher.repo
[rancher]
name=Rancher
baseurl=https://rpm.rancher.io/rancher/production/centos/10/noarch
enabled=1
gpgcheck=1
gpgkey=https://rpm.rancher.io/public.key
EOF
```
### 2. Installing the RPM
Install the RPM:
@@ -75,10 +94,19 @@ yum -y install rancher-selinux
:::note Requirement:
Logging v2 was tested with SELinux on RHEL/CentOS 7, 8 and 9.
Logging v2 was tested with SELinux on RHEL/CentOS 7, 8, 9, and 10.
:::
Applications do not automatically work once the `rancher-selinux` RPM is installed on the host. They need to be configured to run in an allowed SELinux container domain provided by the RPM.
To configure the `rancher-logging` chart to be SELinux aware, change `global.seLinux.enabled` to true in the `values.yaml` when installing the chart.
## Rancher AI SELinux Policies
Starting with `rancher-selinux` v0.9, SELinux policies are included for Rancher AI components:
- **rancher-ai-agent** — runs under the `rancher_aiagent_container_t` SELinux domain
- **rancher-ai-mcp** — runs under the `rancher_aimcp_container_t` SELinux domain
These policies are supported on all platforms: EL9, EL10, Fedora 42, and MicroOS.
versioned_docs/version-2.12/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md
+30 -2
View File
@@ -8,6 +8,12 @@ title: About rancher-selinux
To allow Rancher to work with SELinux, some functionality has to be manually enabled for the SELinux nodes. To help with that, Rancher provides an SELinux RPM.
:::tip Why SELinux?
By assigning a dedicated SELinux type to each container, we ensure that containers are limited to their minimal needs and cannot pivot to other resources if compromised.
:::
The `rancher-selinux` RPM contains a set of SELinux policies designed to grant the necessary privileges to various Rancher components running on Linux systems with SELinux enabled.
The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/rancher-selinux)
@@ -16,7 +22,7 @@ The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/ra
:::note Requirement:
The `rancher-selinux` RPM was tested on openSUSE Tumbleweed and RHEL-based distributions including Centos/RockyLinux 8 and 9.
The `rancher-selinux` RPM was tested on openSUSE MicroOS, Fedora 42, and RHEL-based distributions including CentOS/RockyLinux 8, 9, and 10.
:::
@@ -50,6 +56,19 @@ gpgkey=https://rpm.rancher.io/public.key
EOF
```
In order to use the RPM repository, on a CentOS 10 or RHEL 10 system, run the following bash snippet:
```
# cat << EOF > /etc/yum.repos.d/rancher.repo
[rancher]
name=Rancher
baseurl=https://rpm.rancher.io/rancher/production/centos/10/noarch
enabled=1
gpgcheck=1
gpgkey=https://rpm.rancher.io/public.key
EOF
```
### 2. Installing the RPM
Install the RPM:
@@ -62,10 +81,19 @@ yum -y install rancher-selinux
:::note Requirement:
Logging v2 and Monitoring v2 were tested with SELinux on RHEL/CentOS 8, 9, and Tumbleweed.
Logging v2 and Monitoring v2 were tested with SELinux on RHEL/CentOS 8, 9, 10, and Tumbleweed.
:::
Applications do not automatically work once the `rancher-selinux` RPM is installed on the host. They need to be configured to run in an allowed SELinux container domain provided by the RPM.
To configure the `rancher-logging` or the `rancher-monitoring` chart to be SELinux aware, change `global.seLinux.enabled` to true in the `values.yaml` when installing the charts.
## Rancher AI SELinux Policies
Starting with `rancher-selinux` v0.9, SELinux policies are included for Rancher AI components:
- **rancher-ai-agent** — runs under the `rancher_aiagent_container_t` SELinux domain
- **rancher-ai-mcp** — runs under the `rancher_aimcp_container_t` SELinux domain
These policies are supported on all platforms: EL9, EL10, Fedora 42, and MicroOS.
versioned_docs/version-2.13/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md
+30 -2
View File
@@ -8,6 +8,12 @@ title: About rancher-selinux
To allow Rancher to work with SELinux, some functionality has to be manually enabled for the SELinux nodes. To help with that, Rancher provides an SELinux RPM.
:::tip Why SELinux?
By assigning a dedicated SELinux type to each container, we ensure that containers are limited to their minimal needs and cannot pivot to other resources if compromised.
:::
The `rancher-selinux` RPM contains a set of SELinux policies designed to grant the necessary privileges to various Rancher components running on Linux systems with SELinux enabled.
The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/rancher-selinux)
@@ -16,7 +22,7 @@ The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/ra
:::note Requirement:
The `rancher-selinux` RPM was tested on openSUSE Tumbleweed and RHEL-based distributions including Centos/RockyLinux 8 and 9.
The `rancher-selinux` RPM was tested on openSUSE MicroOS, Fedora 42, and RHEL-based distributions including CentOS/RockyLinux 8, 9, and 10.
:::
@@ -50,6 +56,19 @@ gpgkey=https://rpm.rancher.io/public.key
EOF
```
In order to use the RPM repository, on a CentOS 10 or RHEL 10 system, run the following bash snippet:
```
# cat << EOF > /etc/yum.repos.d/rancher.repo
[rancher]
name=Rancher
baseurl=https://rpm.rancher.io/rancher/production/centos/10/noarch
enabled=1
gpgcheck=1
gpgkey=https://rpm.rancher.io/public.key
EOF
```
### 2. Installing the RPM
Install the RPM:
@@ -62,10 +81,19 @@ yum -y install rancher-selinux
:::note Requirement:
Logging v2 and Monitoring v2 were tested with SELinux on RHEL/CentOS 8, 9, and Tumbleweed.
Logging v2 and Monitoring v2 were tested with SELinux on RHEL/CentOS 8, 9, 10, and Tumbleweed.
:::
Applications do not automatically work once the `rancher-selinux` RPM is installed on the host. They need to be configured to run in an allowed SELinux container domain provided by the RPM.
To configure the `rancher-logging` or the `rancher-monitoring` chart to be SELinux aware, change `global.seLinux.enabled` to true in the `values.yaml` when installing the charts.
## Rancher AI SELinux Policies
Starting with `rancher-selinux` v0.9, SELinux policies are included for Rancher AI components:
- **rancher-ai-agent** — runs under the `rancher_aiagent_container_t` SELinux domain
- **rancher-ai-mcp** — runs under the `rancher_aimcp_container_t` SELinux domain
These policies are supported on all platforms: EL9, EL10, Fedora 42, and MicroOS.