Confine workload container with SELinux instead of label=disable

[MiguelCarpio]

Keep the vLLM container SELinux-confined and grant GPU device access via the container_use_devices boolean, rather than --security-opt=label=disable which removed confinement entirely.

• default gpu_validation_workload_security_opts to "" (was label=disable)
• add tasks/selinux-gpu-access.yaml to set container_use_devices, run unconditionally from main.yaml before the workload
• add ansible.posix to requirements.yaml for the seboolean module

Closes: OSPRH-34584

[coderabbitai]

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: bf6f0c7c-1b3d-4f0c-81d0-e1a24b1baa9c

📥 Commits

Reviewing files that changed from the base of the PR and between 7efa368 and 50547d6.

📒 Files selected for processing (4)

• gpu-validation/defaults/main.yaml
• gpu-validation/tasks/main.yaml
• gpu-validation/tasks/selinux-gpu-access.yaml
• requirements.yaml

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Summary

Summary by CodeRabbit

• Bug Fixes
  • GPU-enabled containers can now access required GPU devices while SELinux is enabled.
  • Container SELinux confinement remains active by default, improving security without preventing supported GPU workloads.
  • SELinux configuration is applied persistently when available.

Walkthrough

The role now preserves SELinux confinement by default and enables persistent container access to GPU devices when SELinux is enabled.

Changes

SELinux GPU access

Layer / File(s)	Summary
Preserve SELinux confinement gpu-validation/defaults/main.yaml	The default container security options no longer disable SELinux labeling.
Enable SELinux GPU access requirements.yaml, gpu-validation/tasks/main.yaml, gpu-validation/tasks/selinux-gpu-access.yaml	The role imports the SELinux task, gathers SELinux facts, and persistently enables container_use_devices when SELinux is enabled. The ansible.posix collection is required at version >=1.5.0.

Priority: ⬇️ Low — Defer this change because it is a narrow gpu-validation update that preserves SELinux confinement while enabling GPU device access.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 50547

The workload remains SELinux-confined by default while configuring GPU device access before startup. No actionable merge-blocking risk remains in the supplied change context.

Sequence Diagram(s)

sequenceDiagram
  participant GPUValidationRole
  participant SELinuxFacts
  participant SELinuxPolicy
  GPUValidationRole->>SELinuxFacts: Gather SELinux status
  SELinuxFacts-->>GPUValidationRole: Return status
  GPUValidationRole->>SELinuxPolicy: Enable container_use_devices when enabled
  SELinuxPolicy-->>GPUValidationRole: Persist policy change

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the primary change: keeping the workload container SELinux-confined instead of disabling SELinux labeling.
Description check	✅ Passed	The description accurately covers the default change, SELinux boolean task, task ordering, collection requirement, and issue reference.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Git: CodeRabbit could not clone the repository, so clone-backed analysis was skipped and this review may be incomplete. Verify repository clone access, such as SSH credentials, before requesting another full review. If clone access is intentionally unavailable, use path_filters to narrow the review scope.

---

_{Comment @coderabbitai help to get the list of available commands.}

[MiguelCarpio]

Test container_use_devices

...
TASK [gpu-validation : Gather SELinux facts] ***********************************
task path: /var/lib/ansible/ansible/gpu-validation/tasks/selinux-gpu-access.yaml:3
ok: [gpu-validation-0]

TASK [gpu-validation : Allow containers to access GPU device nodes under SELinux] ***
task path: /var/lib/ansible/ansible/gpu-validation/tasks/selinux-gpu-access.yaml:9
changed: [gpu-validation-0] => {
    "changed": true,
    "invocation": {
        "module_args": {
            "ignore_selinux_state": false,
            "name": "container_use_devices",
            "persistent": true,
            "state": true
        }
    },
    "name": "container_use_devices",
    "persistent": true,
    "state": true
}

...
TASK [gpu-validation : TEST[model_performance]Check the performance thresholds] ***
task path: /var/lib/ansible/ansible/gpu-validation/tasks/model_performance_assertions.yaml:2
ok: [gpu-validation-0] => {
    "failed_when_result": false,
    "performance_json": {
        "avg_time_per_tok": "0.0099",
        "avg_time_to_first_tok": "0.0221"
    }
}

PLAY RECAP *********************************************************************
gpu-validation-0           : ok=66   changed=26   unreachable=0    failed=0    skipped=44   rescued=0    ignored=0   
localhost                  : ok=20   changed=3    unreachable=0    failed=0    skipped=9    rescued=0    ignored=0