Kubernetes SELinux Volume Label Changes Go GA with v1.37 Implications
The Kubernetes project has announced that the SELinuxMount feature gate is expected to be enabled by default in the upcoming v1.37 release. This change aims to significantly accelerate volume setup for workloads running on Linux systems with SELinux in enforcing mode by replacing slow, recursive file relabeling with efficient mount-time labeling. While this improvement enhances performance, it poses a risk of breaking applications that rely on the older recursive relabeling model, particularly those sharing volumes between privileged and unprivileged Pods. Users operating clusters without SELinux are unaffected. The article advises administrators to use Kubernetes v1.36 to audit their environments, fix compatibility issues, or opt out of the new behavior before the default change occurs. This update builds upon previous optimizations introduced in v1.27 and v1.28, extending efficient SELinux handling from ReadWriteOncePod volumes to broader volume types. To benefit from constant-time mounting, specific conditions must be met, including OS support, enabled feature gates, and appropriate Pod security context configurations. This technical shift represents a critical infrastructure update for container orchestration security and performance.
Wire timeline
Kubernetes SELinux Volume Label Changes Go GA with v1.37 Implications
The Kubernetes project has announced that the SELinuxMount feature gate is expected to be enabled by default in the upcoming v1.37 release. This change aims to significantly accelerate volume setup for workloads running on Linux systems with SELinux in enforcing mode by replacing slow, recursive file relabeling with efficient mount-time labeling. While this improvement enhances performance, it poses a risk of breaking applications that rely on the older recursive relabeling model, particularly those sharing volumes between privileged and unprivileged Pods. Users operating clusters without SELinux are unaffected. The article advises administrators to use Kubernetes v1.36 to audit their environments, fix compatibility issues, or opt out of the new behavior before the default change occurs. This update builds upon previous optimizations introduced in v1.27 and v1.28, extending efficient SELinux handling from ReadWriteOncePod volumes to broader volume types. To benefit from constant-time mounting, specific conditions must be met, including OS support, enabled feature gates, and appropriate Pod security context configurations. This technical shift represents a critical infrastructure update for container orchestration security and performance.
Kubernetes Blog