[feat] Setting timezone under SELinux.

[bbaassssiiee]

What type of PR is this?

Uncomment only one /kind <> line, hit enter to put that in a new line, and remove leading whitespaces from that line:

/kind api-change
/kind bug
/kind cleanup
/kind design
/kind documentation
/kind failing-test
/kind feature
/kind flake

What this PR does / why we need it:
Fix setting timezone under SELinux.

Which issue(s) this PR fixes:

Fixes #12435

Special notes for your reviewer:
Ensure SELinux is enforcing, pre-test with this command:

$ sudo timedatectl set-timezone Europe/Amsterdam
Failed to set time zone: Failed to update /etc/localtime

Does this PR introduce a user-facing change?:

[feat] Setting timezone under SELinux. 

[k8s-ci-robot]

Hi @bbaassssiiee. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[yankay]

/ok-to-test

[bbaassssiiee]

For proper testing this default should change to:

preinstall_selinux_state: enforcing

That would make the cluster more secure by default. What do you think?

[yankay]

HI @bbaassssiiee

It is not recommended to modify SELinux default settings. This is because kubeadm advises using permissive mode, as referenced at:
https://github.com/kubernetes/website/blob/main/content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md?plain=1#L273

Kubernetes provides native security mechanisms such as Pod Security Context. These enable granular permission control at the container level without relying on SELinux's enforcement.

[bbaassssiiee]

I ran Kubespray with calico and local-path for months with SELinux, but don't just take my word for it. The Haven standard (compliance tests for Kubernetes by the Association of Dutch municipalities) requires SELinux or similar for other distros to enabled on the hosts.

This blog has background on why people think SELinux should be disabled, and why that is a myth.
https://dev.to/carminezacc/does-kubernetes-support-selinux-3oop

[bbaassssiiee]

Converted to draft. This conditional should be kept:

 when:
    - ntp_timezone

[bbaassssiiee]

Made this more granular

[bbaassssiiee]

@yankay Tests pass now, please review.

[yankay]

Thanks @bbaassssiiee
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bbaassssiiee, yankay

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [yankay]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[bbaassssiiee]

CI pipeline failure seems unrelated to the PR https://gitlab.com/kargo-ci/kubernetes-sigs-kubespray/-/jobs/11245920993#L8374

[yankay]

Shall we rebase onto master and try again?
I see the latest master branch can still be built successfully.