Rename SupportsSELinux to SELinuxRelabel

The field in fact says that the container runtime should relabel a volume
when running a container with it, it does not say that the volume supports
SELinux. For example, NFS can support SELinux, but we don't want NFS
volumes relabeled, because they can be shared among several Pods.

pkg/kubelet/kubelet_pods.go

@@ -175,7 +175,7 @@ func makeMounts(pod *v1.Pod, podDir string, container *v1.Container, hostName, h
 		// If the volume supports SELinux and it has not been
 		// relabeled already and it is not a read-only volume,
 		// relabel it and mark it as labeled
-		if vol.Mounter.GetAttributes().Managed && vol.Mounter.GetAttributes().SupportsSELinux && !vol.SELinuxLabeled {
+		if vol.Mounter.GetAttributes().Managed && vol.Mounter.GetAttributes().SELinuxRelabel && !vol.SELinuxLabeled {
 			vol.SELinuxLabeled = true
 			relabelVolume = true
 		}

pkg/volume/awsebs/aws_ebs.go

@@ -350,9 +350,9 @@ var _ volume.Mounter = &awsElasticBlockStoreMounter{}
 
 func (b *awsElasticBlockStoreMounter) GetAttributes() volume.Attributes {
 	return volume.Attributes{
-		ReadOnly:        b.readOnly,
+		ReadOnly:       b.readOnly,
-		Managed:         !b.readOnly,
+		Managed:        !b.readOnly,
-		SupportsSELinux: true,
+		SELinuxRelabel: true,
 	}
 }
 

pkg/volume/azure_file/azure_file.go

@@ -239,9 +239,9 @@ var _ volume.Mounter = &azureFileMounter{}
 
 func (b *azureFileMounter) GetAttributes() volume.Attributes {
 	return volume.Attributes{
-		ReadOnly:        b.readOnly,
+		ReadOnly:       b.readOnly,
-		Managed:         !b.readOnly,
+		Managed:        !b.readOnly,
-		SupportsSELinux: false,
+		SELinuxRelabel: false,
 	}
 }
 

pkg/volume/azuredd/azure_mounter.go

@@ -56,9 +56,9 @@ func (m *azureDiskMounter) GetAttributes() volume.Attributes {
 		readOnly = *volumeSource.ReadOnly
 	}
 	return volume.Attributes{
-		ReadOnly:        readOnly,
+		ReadOnly:       readOnly,
-		Managed:         !readOnly,
+		Managed:        !readOnly,
-		SupportsSELinux: true,
+		SELinuxRelabel: true,
 	}
 }
 

pkg/volume/cephfs/cephfs.go

@@ -206,9 +206,9 @@ var _ volume.Mounter = &cephfsMounter{}
 
 func (cephfsVolume *cephfsMounter) GetAttributes() volume.Attributes {
 	return volume.Attributes{
-		ReadOnly:        cephfsVolume.readonly,
+		ReadOnly:       cephfsVolume.readonly,
-		Managed:         false,
+		Managed:        false,
-		SupportsSELinux: false,
+		SELinuxRelabel: false,
 	}
 }
 

pkg/volume/cinder/cinder.go

@@ -371,9 +371,9 @@ type cinderVolume struct {
 
 func (b *cinderVolumeMounter) GetAttributes() volume.Attributes {
 	return volume.Attributes{
-		ReadOnly:        b.readOnly,
+		ReadOnly:       b.readOnly,
-		Managed:         !b.readOnly,
+		Managed:        !b.readOnly,
-		SupportsSELinux: true,
+		SELinuxRelabel: true,
 	}
 }
 

pkg/volume/configmap/configmap.go

@@ -157,9 +157,9 @@ var _ volume.Mounter = &configMapVolumeMounter{}
 
 func (sv *configMapVolume) GetAttributes() volume.Attributes {
 	return volume.Attributes{
-		ReadOnly:        true,
+		ReadOnly:       true,
-		Managed:         true,
+		Managed:        true,
-		SupportsSELinux: true,
+		SELinuxRelabel: true,
 	}
 }
 

pkg/volume/csi/csi_mounter.go

@@ -352,9 +352,9 @@ func (c *csiMountMgr) podServiceAccountTokenAttrs() (map[string]string, error) {
 
 func (c *csiMountMgr) GetAttributes() volume.Attributes {
 	return volume.Attributes{
-		ReadOnly:        c.readOnly,
+		ReadOnly:       c.readOnly,
-		Managed:         !c.readOnly,
+		Managed:        !c.readOnly,
-		SupportsSELinux: c.supportsSELinux,
+		SELinuxRelabel: c.supportsSELinux,
 	}
 }
 

pkg/volume/downwardapi/downwardapi.go

@@ -153,9 +153,9 @@ var _ volume.Mounter = &downwardAPIVolumeMounter{}
 // downward API volumes are always ReadOnlyManaged
 func (d *downwardAPIVolume) GetAttributes() volume.Attributes {
 	return volume.Attributes{
-		ReadOnly:        true,
+		ReadOnly:       true,
-		Managed:         true,
+		Managed:        true,
-		SupportsSELinux: true,
+		SELinuxRelabel: true,
 	}
 }
 

pkg/volume/emptydir/empty_dir.go

@@ -219,9 +219,9 @@ type emptyDir struct {
 
 func (ed *emptyDir) GetAttributes() volume.Attributes {
 	return volume.Attributes{
-		ReadOnly:        false,
+		ReadOnly:       false,
-		Managed:         true,
+		Managed:        true,
-		SupportsSELinux: true,
+		SELinuxRelabel: true,
 	}
 }
 

pkg/volume/fc/fc.go

@@ -364,9 +364,9 @@ var _ volume.Mounter = &fcDiskMounter{}
 
 func (b *fcDiskMounter) GetAttributes() volume.Attributes {
 	return volume.Attributes{
-		ReadOnly:        b.readOnly,
+		ReadOnly:       b.readOnly,
-		Managed:         !b.readOnly,
+		Managed:        !b.readOnly,
-		SupportsSELinux: true,
+		SELinuxRelabel: true,
 	}
 }
 

pkg/volume/flexvolume/mounter-defaults.go

@@ -45,9 +45,9 @@ func (f *mounterDefaults) SetUpAt(dir string, mounterArgs volume.MounterArgs) er
 func (f *mounterDefaults) GetAttributes() volume.Attributes {
 	klog.V(5).Info(logPrefix(f.plugin), "using default GetAttributes")
 	return volume.Attributes{
-		ReadOnly:        f.readOnly,
+		ReadOnly:       f.readOnly,
-		Managed:         !f.readOnly,
+		Managed:        !f.readOnly,
-		SupportsSELinux: f.flexVolume.plugin.capabilities.SELinuxRelabel,
+		SELinuxRelabel: f.flexVolume.plugin.capabilities.SELinuxRelabel,
 	}
 }
 

pkg/volume/flocker/flocker.go

@@ -214,9 +214,9 @@ type flockerVolumeMounter struct {
 
 func (b *flockerVolumeMounter) GetAttributes() volume.Attributes {
 	return volume.Attributes{
-		ReadOnly:        b.readOnly,
+		ReadOnly:       b.readOnly,
-		Managed:         false,
+		Managed:        false,
-		SupportsSELinux: false,
+		SELinuxRelabel: false,
 	}
 }
 

pkg/volume/gcepd/gce_pd.go

@@ -354,9 +354,9 @@ var _ volume.Mounter = &gcePersistentDiskMounter{}
 
 func (b *gcePersistentDiskMounter) GetAttributes() volume.Attributes {
 	return volume.Attributes{
-		ReadOnly:        b.readOnly,
+		ReadOnly:       b.readOnly,
-		Managed:         !b.readOnly,
+		Managed:        !b.readOnly,
-		SupportsSELinux: true,
+		SELinuxRelabel: true,
 	}
 }
 

pkg/volume/git_repo/git_repo.go

@@ -161,9 +161,9 @@ var _ volume.Mounter = &gitRepoVolumeMounter{}
 
 func (b *gitRepoVolumeMounter) GetAttributes() volume.Attributes {
 	return volume.Attributes{
-		ReadOnly:        false,
+		ReadOnly:       false,
-		Managed:         true,
+		Managed:        true,
-		SupportsSELinux: true, // xattr change should be okay, TODO: double check
+		SELinuxRelabel: true, // xattr change should be okay, TODO: double check
 	}
 }
 

pkg/volume/glusterfs/glusterfs.go

@@ -251,9 +251,9 @@ var _ volume.Mounter = &glusterfsMounter{}
 
 func (b *glusterfsMounter) GetAttributes() volume.Attributes {
 	return volume.Attributes{
-		ReadOnly:        b.readOnly,
+		ReadOnly:       b.readOnly,
-		Managed:         false,
+		Managed:        false,
-		SupportsSELinux: false,
+		SELinuxRelabel: false,
 	}
 }
 

pkg/volume/hostpath/host_path.go

@@ -212,9 +212,9 @@ var _ volume.Mounter = &hostPathMounter{}
 
 func (b *hostPathMounter) GetAttributes() volume.Attributes {
 	return volume.Attributes{
-		ReadOnly:        b.readOnly,
+		ReadOnly:       b.readOnly,
-		Managed:         false,
+		Managed:        false,
-		SupportsSELinux: false,
+		SELinuxRelabel: false,
 	}
 }
 

pkg/volume/iscsi/iscsi.go

@@ -346,9 +346,9 @@ var _ volume.Mounter = &iscsiDiskMounter{}
 
 func (b *iscsiDiskMounter) GetAttributes() volume.Attributes {
 	return volume.Attributes{
-		ReadOnly:        b.readOnly,
+		ReadOnly:       b.readOnly,
-		Managed:         !b.readOnly,
+		Managed:        !b.readOnly,
-		SupportsSELinux: true,
+		SELinuxRelabel: true,
 	}
 }
 

pkg/volume/local/local.go

@@ -504,9 +504,9 @@ var _ volume.Mounter = &localVolumeMounter{}
 
 func (m *localVolumeMounter) GetAttributes() volume.Attributes {
 	return volume.Attributes{
-		ReadOnly:        m.readOnly,
+		ReadOnly:       m.readOnly,
-		Managed:         !m.readOnly,
+		Managed:        !m.readOnly,
-		SupportsSELinux: true,
+		SELinuxRelabel: true,
 	}
 }
 

pkg/volume/nfs/nfs.go

@@ -18,11 +18,12 @@ package nfs
 
 import (
 	"fmt"
-	netutil "k8s.io/utils/net"
 	"os"
 	"runtime"
 	"time"
 
+	netutil "k8s.io/utils/net"
+
 	"k8s.io/klog/v2"
 	"k8s.io/mount-utils"
 	utilstrings "k8s.io/utils/strings"
@@ -232,9 +233,9 @@ var _ volume.Mounter = &nfsMounter{}
 
 func (nfsMounter *nfsMounter) GetAttributes() volume.Attributes {
 	return volume.Attributes{
-		ReadOnly:        nfsMounter.readOnly,
+		ReadOnly:       nfsMounter.readOnly,
-		Managed:         false,
+		Managed:        false,
-		SupportsSELinux: false,
+		SELinuxRelabel: false,
 	}
 }
 

pkg/volume/portworx/portworx.go

@@ -18,10 +18,11 @@ package portworx
 
 import (
 	"fmt"
+	"os"
+
 	"k8s.io/klog/v2"
 	"k8s.io/mount-utils"
 	utilstrings "k8s.io/utils/strings"
-	"os"
 
 	volumeclient "github.com/libopenstorage/openstorage/api/client/volume"
 	v1 "k8s.io/api/core/v1"
@@ -287,9 +288,9 @@ var _ volume.Mounter = &portworxVolumeMounter{}
 
 func (b *portworxVolumeMounter) GetAttributes() volume.Attributes {
 	return volume.Attributes{
-		ReadOnly:        b.readOnly,
+		ReadOnly:       b.readOnly,
-		Managed:         !b.readOnly,
+		Managed:        !b.readOnly,
-		SupportsSELinux: false,
+		SELinuxRelabel: false,
 	}
 }
 

pkg/volume/projected/projected.go

@@ -168,9 +168,9 @@ var _ volume.Mounter = &projectedVolumeMounter{}
 
 func (sv *projectedVolume) GetAttributes() volume.Attributes {
 	return volume.Attributes{
-		ReadOnly:        true,
+		ReadOnly:       true,
-		Managed:         true,
+		Managed:        true,
-		SupportsSELinux: true,
+		SELinuxRelabel: true,
 	}
 
 }

pkg/volume/quobyte/quobyte.go

@@ -225,9 +225,9 @@ var _ volume.Mounter = &quobyteMounter{}
 
 func (mounter *quobyteMounter) GetAttributes() volume.Attributes {
 	return volume.Attributes{
-		ReadOnly:        mounter.readOnly,
+		ReadOnly:       mounter.readOnly,
-		Managed:         false,
+		Managed:        false,
-		SupportsSELinux: false,
+		SELinuxRelabel: false,
 	}
 }
 

pkg/volume/rbd/rbd.go

@@ -19,28 +19,27 @@ package rbd
 import (
 	"context"
 	"fmt"
-	utilfeature "k8s.io/apiserver/pkg/util/feature"
-	"k8s.io/kubernetes/pkg/features"
 	"os"
 	"path/filepath"
 	"regexp"
 	dstrings "strings"
 
-	"k8s.io/klog/v2"
-	"k8s.io/mount-utils"
-	utilexec "k8s.io/utils/exec"
-	utilstrings "k8s.io/utils/strings"
-
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/apimachinery/pkg/util/uuid"
+	utilfeature "k8s.io/apiserver/pkg/util/feature"
 	clientset "k8s.io/client-go/kubernetes"
+	"k8s.io/klog/v2"
+	"k8s.io/kubernetes/pkg/features"
 	"k8s.io/kubernetes/pkg/volume"
 	volutil "k8s.io/kubernetes/pkg/volume/util"
 	"k8s.io/kubernetes/pkg/volume/util/volumepathhandler"
+	"k8s.io/mount-utils"
+	utilexec "k8s.io/utils/exec"
+	utilstrings "k8s.io/utils/strings"
 )
 
 var (
@@ -832,9 +831,9 @@ var _ volume.Mounter = &rbdMounter{}
 
 func (rbd *rbd) GetAttributes() volume.Attributes {
 	return volume.Attributes{
-		ReadOnly:        rbd.ReadOnly,
+		ReadOnly:       rbd.ReadOnly,
-		Managed:         !rbd.ReadOnly,
+		Managed:        !rbd.ReadOnly,
-		SupportsSELinux: true,
+		SELinuxRelabel: true,
 	}
 }
 

pkg/volume/secret/secret.go

@@ -162,9 +162,9 @@ var _ volume.Mounter = &secretVolumeMounter{}
 
 func (sv *secretVolume) GetAttributes() volume.Attributes {
 	return volume.Attributes{
-		ReadOnly:        true,
+		ReadOnly:       true,
-		Managed:         true,
+		Managed:        true,
-		SupportsSELinux: true,
+		SELinuxRelabel: true,
 	}
 }
 

pkg/volume/storageos/storageos.go

@@ -328,9 +328,9 @@ var _ volume.Mounter = &storageosMounter{}
 
 func (b *storageosMounter) GetAttributes() volume.Attributes {
 	return volume.Attributes{
-		ReadOnly:        b.readOnly,
+		ReadOnly:       b.readOnly,
-		Managed:         !b.readOnly,
+		Managed:        !b.readOnly,
-		SupportsSELinux: true,
+		SELinuxRelabel: true,
 	}
 }
 

pkg/volume/testing/testing.go

@@ -686,9 +686,9 @@ func getUniqueVolumeName(spec *Spec) (string, error) {
 
 func (_ *FakeVolume) GetAttributes() Attributes {
 	return Attributes{
-		ReadOnly:        false,
+		ReadOnly:       false,
-		Managed:         true,
+		Managed:        true,
-		SupportsSELinux: true,
+		SELinuxRelabel: true,
 	}
 }
 

pkg/volume/volume.go

@@ -115,9 +115,9 @@ type Metrics struct {
 
 // Attributes represents the attributes of this mounter.
 type Attributes struct {
-	ReadOnly        bool
+	ReadOnly       bool
-	Managed         bool
+	Managed        bool
-	SupportsSELinux bool
+	SELinuxRelabel bool
 }
 
 // MounterArgs provides more easily extensible arguments to Mounter

pkg/volume/vsphere_volume/vsphere_volume.go

@@ -208,8 +208,8 @@ type vsphereVolumeMounter struct {
 
 func (b *vsphereVolumeMounter) GetAttributes() volume.Attributes {
 	return volume.Attributes{
-		SupportsSELinux: true,
+		SELinuxRelabel: true,
-		Managed:         true,
+		Managed:        true,
 	}
 }