loading of added selinux policies

roles/rke2/tasks/setup_host.yml

@@ -88,22 +88,43 @@
     dest: /etc/selinux/targeted/policy/my-kube-apiserver.te
   when: ( 'control-plane' in group_names )
 
+- name: Build SELinux exception module (kube-apiserver)
+  shell: |
+    checkmodule -M -m -o /etc/selinux/targeted/policy/my-kube-apiserver.mod /etc/selinux/targeted/policy/my-kube-apiserver.te
+    semodule_package -o /etc/selinux/targeted/policy/my-kube-apiserver.pp -m /etc/selinux/targeted/policy/my-kube-apiserver.mod
+    semodule -i /etc/selinux/targeted/policy/my-kube-apiserver.pp
+  when: ( 'control-plane' in group_names )
+
 - name: Copy SELinux Policies (prometheus/node_exporter)
   template:
     src: ../selinux/my-prometheus_master.te
     dest: /etc/selinux/targeted/policy/my-prometheus.te
   when: ( 'control-plane' in group_names )
 
+- name: Copy SELinux Policies (prometheus/node_exporter) on agents
+  template:
+    src: ../selinux/my-prometheus_agent.te
+    dest: /etc/selinux/targeted/policy/my-prometheus.te
+  when: ( 'control-plane' not in group_names )
+
+
+- name: Build SELinux exception module (prometheus/node_exporter)
+  shell: |
+    checkmodule -M -m -o /etc/selinux/targeted/policy/my-prometheus.mod /etc/selinux/targeted/policy/my-prometheus.te
+    semodule_package -o /etc/selinux/targeted/policy/my-prometheus.pp -m /etc/selinux/targeted/policy/my-prometheus.mod
+    semodule -i /etc/selinux/targeted/policy/my-prometheus.pp
+
 - name: Copy SELinux Policies (hubble) on agents
   template:
     src: ../selinux/my-hubble.te
     dest: /etc/selinux/targeted/policy/my-hubble.te
   when: ( 'control-plane' not in group_names )
 
-- name: Copy SELinux Policies (prometheus/node_exporter) on agents
-  template:
-    src: ../selinux/my-prometheus_agent.te
-    dest: /etc/selinux/targeted/policy/my-prometheus.te
+- name: Build SELinux exception module (hubble)
+  shell: |
+    checkmodule -M -m -o /etc/selinux/targeted/policy/my-hubble.mod /etc/selinux/targeted/policy/my-hubble.te
+    semodule_package -o /etc/selinux/targeted/policy/my-hubble.pp -m /etc/selinux/targeted/policy/my-hubble.mod
+    semodule -i /etc/selinux/targeted/policy/my-hubble.pp
   when: ( 'control-plane' not in group_names )