diff --git a/roles/rke2/selinux/my-openstack.te b/roles/rke2/selinux/my-openstack.te
index 0b45d048e31c1db49a1b3357438e6deb90da31d1..008be38b54a7e5d4ea9b8162118a628ed726175d 100644
--- a/roles/rke2/selinux/my-openstack.te
+++ b/roles/rke2/selinux/my-openstack.te
@@ -8,3 +8,4 @@ require {
 
 #============= container_t ==============
 allow container_t cert_t:dir read;
+allow container_t cert_t:lnk_file read;