removed unnecessary selinux rules

added rke2 selinux rule

roles/rke2/selinux/my-hubble.cil

-(block my-hubble
-    (blockinherit container)
-    (allow container_runtime_t init_t (bpf (prog_run)))
-)

roles/rke2/selinux/my-kube-apiserver.cil

-(block my-kube-apiserver
-    (blockinherit container)
-    (allow rke2_service_t container_var_lib_t (file (watch)))
-)

roles/rke2/selinux/my-node-exporter.cil

 (block my-node-exporter
     (blockinherit container)
-    (allow container_t init_t (dir (search)))
-    (allow container_t init_t (file (read open)))
+    (allow my-node-exporter.process init_t (dir (search)))
+    (allow my-node-exporter.process init_t (file (read open)))
     (allow my-node-exporter.process node_t (tcp_socket (node_bind)))
     (allow my-node-exporter.process unreserved_port_t (tcp_socket (name_bind)))
     (allow my-node-exporter.process self (tcp_socket (listen)))

roles/rke2/selinux/my-openstack-ccm.cil

+(block my-openstack-ccm
+    (blockinherit container)
+    (allow my-openstack-ccm.process commplex_main_port_t (tcp_socket (name_connect)))
+    (allow my-openstack-ccm.process node_t (tcp_socket (node_bind)))
+    (allow my-openstack-ccm.process unreserved_port_t (tcp_socket (name_bind)))
+    (allow my-openstack-ccm.process self (tcp_socket (listen)))
+    (allow my-openstack-ccm.process http_port_t (tcp_socket (name_connect)))
+    (allow my-openstack-ccm.process osapi_compute_port_t (tcp_socket (name_connect)))
+    (allow my-openstack-ccm.process neutron_port_t (tcp_socket (name_connect)))
+    (allow my-openstack-ccm.process cert_t (dir (read)))
+    (allow my-openstack-ccm.process cert_t (lnk_file (read)))
+    (allow my-openstack-ccm.process cert_t (file (open read write)))
+)
+

roles/rke2/selinux/my-openstack.cil

-(block my-openstack
-    (blockinherit container)
-    (allow container_t cert_t (dir (read)))
-    (allow container_t cert_t (lnk_file read)))
-    (allow container_t cert_t (file (open read write)))
-)

roles/rke2/selinux/my-rke2.te

+module my-rke2 1.0;
+
+require {
+        type container_var_lib_t;
+        type rke2_service_t;
+        class file watch;
+}
+
+
+#============= rke2_service_t ==============
+allow rke2_service_t container_var_lib_t:file watch;

roles/rke2/tasks/install_rke2.yml

@@ -36,3 +36,17 @@
   file:
     path: /tmp/rke2.sh
     state: absent
+
+- name: Copy SELinux Policies (rke2)
+  template:
+    src: ../selinux/my-rke2.te
+    dest: /etc/selinux/targeted/policy/my-rke2.te
+  when: ( 'control-plane' in group_names )
+
+- name: Build SELinux exception module (rke2)
+  shell: |
+    checkmodule -M -m -o /etc/selinux/targeted/policy/my-rke2.mod /etc/selinux/targeted/policy/my-rke2.te
+    semodule_package -o /etc/selinux/targeted/policy/my-rke2.pp -m /etc/selinux/targeted/policy/my-rke2.mod
+    semodule -i /etc/selinux/targeted/policy/my-rke2.pp
+  when: ( 'control-plane' in group_names )
+

roles/rke2/tasks/setup_host.yml

@@ -72,10 +72,15 @@
     /usr/sbin/pvresize -y -q /dev/vda2 
     /usr/sbin/lvresize -y -q -r -l +100%FREE /dev/mapper/*root 
 
+- name: Copy udica Base Container SELinux Policies 
+  template:
+    src: ../selinux/udica/base-container.cil
+    dest: /etc/selinux/targeted/policy/base-container.cil
+
 - name: Copy SELinux Policies (prometheus/node_exporter)
   template:
     src: ../selinux/my-node-exporter.cil
-    dest: /etc/selinux/targeted/policy/my-noe-exporter.cil
+    dest: /etc/selinux/targeted/policy/my-node-exporter.cil
 
 - name: Copy SELinux Policies (prometheus/node_exporter)
   template:
@@ -84,8 +89,18 @@
 
 - name: Copy SELinux Policies
   template:
-    src: ../selinux/my-openstack.cil
-    dest: /etc/selinux/targeted/policy/my-openstack.cil
+    src: ../selinux/my-openstack-ccm.cil
+    dest: /etc/selinux/targeted/policy/my-openstack-ccm.cil
+  when: ( 'control-plane' in group_names )
+
+- name: Build SELinux exception modules
+  shell: |
+    semodule -i /etc/selinux/targeted/policy/my-node-exporter.cil /etc/selinux/targeted/policy/base-container.cil
+
+- name: Build SELinux exception modules
+  shell: |
+    semodule -i /etc/selinux/targeted/policy/my-openstack-ccm.cil /etc/selinux/targeted/policy/base-container.cil
+  when: ( 'control-plane' in group_names )
 
 - name: Disable SELinux
   selinux:

roles/rke2/templates/manifests/deploy-openstack-ccm.j2

@@ -55,4 +55,9 @@ spec:
     {#resources:
     #  requests:
     #    cpu: 200m
-    #}
+    #}
\ No newline at end of file
+
+    securityContext:
+      seLinuxOptions:
+         type: my-openstack-ccm.process
+