From be9dc306473ef5bcca7cc878e162874ad1f365b9 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 28 May 2026 08:50:34 +0000 Subject: [PATCH] docs: update rancher-selinux docs for v0.9 across versions --- .../selinux-rpm/about-rancher-selinux.md | 32 +++++++++++++++++-- .../selinux-rpm/about-rancher-selinux.md | 32 +++++++++++++++++-- .../selinux-rpm/about-rancher-selinux.md | 32 +++++++++++++++++-- .../selinux-rpm/about-rancher-selinux.md | 32 +++++++++++++++++-- .../selinux-rpm/about-rancher-selinux.md | 32 +++++++++++++++++-- 5 files changed, 150 insertions(+), 10 deletions(-) diff --git a/docs/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md b/docs/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md index b3be3dade1c..7639d92ccb5 100644 --- a/docs/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md +++ b/docs/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md @@ -8,6 +8,12 @@ title: About rancher-selinux To allow Rancher to work with SELinux, some functionality has to be manually enabled for the SELinux nodes. To help with that, Rancher provides an SELinux RPM. +:::tip Why SELinux? + +By assigning a dedicated SELinux type to each container, we ensure that containers are limited to their minimal needs and cannot pivot to other resources if compromised. + +::: + The `rancher-selinux` RPM contains a set of SELinux policies designed to grant the necessary privileges to various Rancher components running on Linux systems with SELinux enabled. The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/rancher-selinux) @@ -16,7 +22,7 @@ The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/ra :::note Requirement: -The `rancher-selinux` RPM was tested on openSUSE Tumbleweed and RHEL-based distributions including Centos/RockyLinux 8 and 9. +The `rancher-selinux` RPM was tested on openSUSE MicroOS, Fedora 42, and RHEL-based distributions including CentOS/RockyLinux 8, 9, and 10. ::: @@ -50,6 +56,19 @@ gpgkey=https://rpm.rancher.io/public.key EOF ``` +In order to use the RPM repository, on a CentOS 10 or RHEL 10 system, run the following bash snippet: + +``` +# cat << EOF > /etc/yum.repos.d/rancher.repo +[rancher] +name=Rancher +baseurl=https://rpm.rancher.io/rancher/production/centos/10/noarch +enabled=1 +gpgcheck=1 +gpgkey=https://rpm.rancher.io/public.key +EOF +``` + ### 2. Installing the RPM Install the RPM: @@ -62,10 +81,19 @@ yum -y install rancher-selinux :::note Requirement: -Logging v2 and Monitoring v2 were tested with SELinux on RHEL/CentOS 8, 9, and Tumbleweed. +Logging v2 and Monitoring v2 were tested with SELinux on RHEL/CentOS 8, 9, 10, and Tumbleweed. ::: Applications do not automatically work once the `rancher-selinux` RPM is installed on the host. They need to be configured to run in an allowed SELinux container domain provided by the RPM. To configure the `rancher-logging` or the `rancher-monitoring` chart to be SELinux aware, change `global.seLinux.enabled` to true in the `values.yaml` when installing the charts. + +## Rancher AI SELinux Policies + +Starting with `rancher-selinux` v0.9, SELinux policies are included for Rancher AI components: + +- **rancher-ai-agent** — runs under the `rancher_aiagent_container_t` SELinux domain +- **rancher-ai-mcp** — runs under the `rancher_aimcp_container_t` SELinux domain + +These policies are supported on all platforms: EL9, EL10, Fedora 42, and MicroOS. diff --git a/versioned_docs/version-2.10/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md b/versioned_docs/version-2.10/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md index 2a9adf1e4f2..3261c24fb00 100644 --- a/versioned_docs/version-2.10/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md +++ b/versioned_docs/version-2.10/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md @@ -8,6 +8,12 @@ title: About rancher-selinux To allow Rancher to work with SELinux, some functionality has to be manually enabled for the SELinux nodes. To help with that, Rancher provides an SELinux RPM. +:::tip Why SELinux? + +By assigning a dedicated SELinux type to each container, we ensure that containers are limited to their minimal needs and cannot pivot to other resources if compromised. + +::: + The `rancher-selinux` RPM contains a set of SELinux policies designed to grant the necessary privileges to various Rancher components running on Linux systems with SELinux enabled. The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/rancher-selinux) @@ -16,7 +22,7 @@ The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/ra :::note Requirement: -The rancher-selinux RPM was tested with CentOS 7, 8 and 9. +The `rancher-selinux` RPM was tested with CentOS 7, 8, 9, and 10. ::: @@ -63,6 +69,19 @@ gpgkey=https://rpm.rancher.io/public.key EOF ``` +In order to use the RPM repository, on a CentOS 10 or RHEL 10 system, run the following bash snippet: + +``` +# cat << EOF > /etc/yum.repos.d/rancher.repo +[rancher] +name=Rancher +baseurl=https://rpm.rancher.io/rancher/production/centos/10/noarch +enabled=1 +gpgcheck=1 +gpgkey=https://rpm.rancher.io/public.key +EOF +``` + ### 2. Installing the RPM Install the RPM: @@ -75,10 +94,19 @@ yum -y install rancher-selinux :::note Requirement: -Logging v2 was tested with SELinux on RHEL/CentOS 7, 8 and 9. +Logging v2 was tested with SELinux on RHEL/CentOS 7, 8, 9, and 10. ::: Applications do not automatically work once the `rancher-selinux` RPM is installed on the host. They need to be configured to run in an allowed SELinux container domain provided by the RPM. To configure the `rancher-logging` chart to be SELinux aware, change `global.seLinux.enabled` to true in the `values.yaml` when installing the chart. + +## Rancher AI SELinux Policies + +Starting with `rancher-selinux` v0.9, SELinux policies are included for Rancher AI components: + +- **rancher-ai-agent** — runs under the `rancher_aiagent_container_t` SELinux domain +- **rancher-ai-mcp** — runs under the `rancher_aimcp_container_t` SELinux domain + +These policies are supported on all platforms: EL9, EL10, Fedora 42, and MicroOS. diff --git a/versioned_docs/version-2.11/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md b/versioned_docs/version-2.11/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md index 2a9adf1e4f2..3261c24fb00 100644 --- a/versioned_docs/version-2.11/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md +++ b/versioned_docs/version-2.11/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md @@ -8,6 +8,12 @@ title: About rancher-selinux To allow Rancher to work with SELinux, some functionality has to be manually enabled for the SELinux nodes. To help with that, Rancher provides an SELinux RPM. +:::tip Why SELinux? + +By assigning a dedicated SELinux type to each container, we ensure that containers are limited to their minimal needs and cannot pivot to other resources if compromised. + +::: + The `rancher-selinux` RPM contains a set of SELinux policies designed to grant the necessary privileges to various Rancher components running on Linux systems with SELinux enabled. The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/rancher-selinux) @@ -16,7 +22,7 @@ The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/ra :::note Requirement: -The rancher-selinux RPM was tested with CentOS 7, 8 and 9. +The `rancher-selinux` RPM was tested with CentOS 7, 8, 9, and 10. ::: @@ -63,6 +69,19 @@ gpgkey=https://rpm.rancher.io/public.key EOF ``` +In order to use the RPM repository, on a CentOS 10 or RHEL 10 system, run the following bash snippet: + +``` +# cat << EOF > /etc/yum.repos.d/rancher.repo +[rancher] +name=Rancher +baseurl=https://rpm.rancher.io/rancher/production/centos/10/noarch +enabled=1 +gpgcheck=1 +gpgkey=https://rpm.rancher.io/public.key +EOF +``` + ### 2. Installing the RPM Install the RPM: @@ -75,10 +94,19 @@ yum -y install rancher-selinux :::note Requirement: -Logging v2 was tested with SELinux on RHEL/CentOS 7, 8 and 9. +Logging v2 was tested with SELinux on RHEL/CentOS 7, 8, 9, and 10. ::: Applications do not automatically work once the `rancher-selinux` RPM is installed on the host. They need to be configured to run in an allowed SELinux container domain provided by the RPM. To configure the `rancher-logging` chart to be SELinux aware, change `global.seLinux.enabled` to true in the `values.yaml` when installing the chart. + +## Rancher AI SELinux Policies + +Starting with `rancher-selinux` v0.9, SELinux policies are included for Rancher AI components: + +- **rancher-ai-agent** — runs under the `rancher_aiagent_container_t` SELinux domain +- **rancher-ai-mcp** — runs under the `rancher_aimcp_container_t` SELinux domain + +These policies are supported on all platforms: EL9, EL10, Fedora 42, and MicroOS. diff --git a/versioned_docs/version-2.12/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md b/versioned_docs/version-2.12/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md index b3be3dade1c..7639d92ccb5 100644 --- a/versioned_docs/version-2.12/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md +++ b/versioned_docs/version-2.12/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md @@ -8,6 +8,12 @@ title: About rancher-selinux To allow Rancher to work with SELinux, some functionality has to be manually enabled for the SELinux nodes. To help with that, Rancher provides an SELinux RPM. +:::tip Why SELinux? + +By assigning a dedicated SELinux type to each container, we ensure that containers are limited to their minimal needs and cannot pivot to other resources if compromised. + +::: + The `rancher-selinux` RPM contains a set of SELinux policies designed to grant the necessary privileges to various Rancher components running on Linux systems with SELinux enabled. The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/rancher-selinux) @@ -16,7 +22,7 @@ The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/ra :::note Requirement: -The `rancher-selinux` RPM was tested on openSUSE Tumbleweed and RHEL-based distributions including Centos/RockyLinux 8 and 9. +The `rancher-selinux` RPM was tested on openSUSE MicroOS, Fedora 42, and RHEL-based distributions including CentOS/RockyLinux 8, 9, and 10. ::: @@ -50,6 +56,19 @@ gpgkey=https://rpm.rancher.io/public.key EOF ``` +In order to use the RPM repository, on a CentOS 10 or RHEL 10 system, run the following bash snippet: + +``` +# cat << EOF > /etc/yum.repos.d/rancher.repo +[rancher] +name=Rancher +baseurl=https://rpm.rancher.io/rancher/production/centos/10/noarch +enabled=1 +gpgcheck=1 +gpgkey=https://rpm.rancher.io/public.key +EOF +``` + ### 2. Installing the RPM Install the RPM: @@ -62,10 +81,19 @@ yum -y install rancher-selinux :::note Requirement: -Logging v2 and Monitoring v2 were tested with SELinux on RHEL/CentOS 8, 9, and Tumbleweed. +Logging v2 and Monitoring v2 were tested with SELinux on RHEL/CentOS 8, 9, 10, and Tumbleweed. ::: Applications do not automatically work once the `rancher-selinux` RPM is installed on the host. They need to be configured to run in an allowed SELinux container domain provided by the RPM. To configure the `rancher-logging` or the `rancher-monitoring` chart to be SELinux aware, change `global.seLinux.enabled` to true in the `values.yaml` when installing the charts. + +## Rancher AI SELinux Policies + +Starting with `rancher-selinux` v0.9, SELinux policies are included for Rancher AI components: + +- **rancher-ai-agent** — runs under the `rancher_aiagent_container_t` SELinux domain +- **rancher-ai-mcp** — runs under the `rancher_aimcp_container_t` SELinux domain + +These policies are supported on all platforms: EL9, EL10, Fedora 42, and MicroOS. diff --git a/versioned_docs/version-2.13/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md b/versioned_docs/version-2.13/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md index b3be3dade1c..7639d92ccb5 100644 --- a/versioned_docs/version-2.13/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md +++ b/versioned_docs/version-2.13/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md @@ -8,6 +8,12 @@ title: About rancher-selinux To allow Rancher to work with SELinux, some functionality has to be manually enabled for the SELinux nodes. To help with that, Rancher provides an SELinux RPM. +:::tip Why SELinux? + +By assigning a dedicated SELinux type to each container, we ensure that containers are limited to their minimal needs and cannot pivot to other resources if compromised. + +::: + The `rancher-selinux` RPM contains a set of SELinux policies designed to grant the necessary privileges to various Rancher components running on Linux systems with SELinux enabled. The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/rancher-selinux) @@ -16,7 +22,7 @@ The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/ra :::note Requirement: -The `rancher-selinux` RPM was tested on openSUSE Tumbleweed and RHEL-based distributions including Centos/RockyLinux 8 and 9. +The `rancher-selinux` RPM was tested on openSUSE MicroOS, Fedora 42, and RHEL-based distributions including CentOS/RockyLinux 8, 9, and 10. ::: @@ -50,6 +56,19 @@ gpgkey=https://rpm.rancher.io/public.key EOF ``` +In order to use the RPM repository, on a CentOS 10 or RHEL 10 system, run the following bash snippet: + +``` +# cat << EOF > /etc/yum.repos.d/rancher.repo +[rancher] +name=Rancher +baseurl=https://rpm.rancher.io/rancher/production/centos/10/noarch +enabled=1 +gpgcheck=1 +gpgkey=https://rpm.rancher.io/public.key +EOF +``` + ### 2. Installing the RPM Install the RPM: @@ -62,10 +81,19 @@ yum -y install rancher-selinux :::note Requirement: -Logging v2 and Monitoring v2 were tested with SELinux on RHEL/CentOS 8, 9, and Tumbleweed. +Logging v2 and Monitoring v2 were tested with SELinux on RHEL/CentOS 8, 9, 10, and Tumbleweed. ::: Applications do not automatically work once the `rancher-selinux` RPM is installed on the host. They need to be configured to run in an allowed SELinux container domain provided by the RPM. To configure the `rancher-logging` or the `rancher-monitoring` chart to be SELinux aware, change `global.seLinux.enabled` to true in the `values.yaml` when installing the charts. + +## Rancher AI SELinux Policies + +Starting with `rancher-selinux` v0.9, SELinux policies are included for Rancher AI components: + +- **rancher-ai-agent** — runs under the `rancher_aiagent_container_t` SELinux domain +- **rancher-ai-mcp** — runs under the `rancher_aimcp_container_t` SELinux domain + +These policies are supported on all platforms: EL9, EL10, Fedora 42, and MicroOS.