Unable to run `make generate` about cluster-monitoring-operator HOT 6 CLOSED

This is an SELinux issue, the files need to be labled as container_t (if I remember correctly) for this to work. I've been working around this locally by running the generate outside a container, since my environment is already set up with all the required dependencies (go, pyyaml):

make merge-cluster-roles assets docs

Another option is to set SELinux to permissive mode before running make generate. Generally though I think it's another sign we should improve the process to not have any hurdles like this one.

from cluster-monitoring-operator.

Disabling SELinux does the trick. Thanks @elad661 !!!

from cluster-monitoring-operator.

Disabling SELinux should not be the solution. We should figure out what is mislabeled and fix it. RUnning something like containers with SELinux disabled is asking for trouble.

The label to assign is container_file_t, container_t is a process label, and can not be assigned to content.

from cluster-monitoring-operator.

@rhatdan Nothing is "mislabeled" in a way that we can fix properly. What happens here is simple: make generate mounts the cluster-monitoring-operator source tree as a volume for the container (see https://github.com/openshift/cluster-monitoring-operator/blob/master/Makefile#L48 ), and because all the files are (probably) labeled user_home_t SELinux doesn't allow the container to access any of them.

I think the proper way to fix this would be moving away from using a container for make generate, since it's reasonable to expect people who contribute to cluster-monitoring-operator will have Go installed on their development machine.

from cluster-monitoring-operator.

Can you disable enforcement in the container IE Run with label:disable rather then disable the selinux on the host.

from cluster-monitoring-operator.

Thanks @rhatdan, that works. I'll send a PR to add that parameter to the Makefile.

Note that I never advocated for disabling SELinux, I just suggested setting it to permissive mode as a temporary workaround.

from cluster-monitoring-operator.