chore: add missing node label step (coder#828)

jawnsy · Katie Horne · web-flow · commit e6b1ee1241b6 · 2022-02-07T17:45:03.000-08:00
With the example deployment manifest for smarter-device-manager,
users need to label compatible nodes in order for the DaemonSet
to run.

Co-authored-by: Katie Horne &lt;katie@coder.com&gt;
diff --git a/guides/deployments/podman.md b/guides/deployments/podman.md
@@ -42,6 +42,7 @@ Linux kernel doesn't support CVMs.
            values:
              - system-node-critical
              - system-cluster-critical
+
    ---
    apiVersion: v1
    kind: ConfigMap
@@ -127,79 +128,124 @@ Linux kernel doesn't support CVMs.
    kubectl apply -f ./smarter-device-manager.yaml
    ```
 
+   The example `DaemonSet` includes a `nodeSelector` that constrains the device
+   plugin to nodes with the `smarter-device-manager` label set to `enabled`.
+   Label the nodes that will include the FUSE device by using the following
+   command, or remove the `nodeSelector` from the manifest:
+
+   ```console
+   kubectl get nodes
+   kubectl label nodes --all smarter-device-manager=enabled 
+   ```
+
 1. If you haven't already done so for your Coder deployment, enable workspace
    templates. To do so, go to **Manage** > **Admin** > **Templates**, and set
    the **Enable workspace templates** to **On**. Click **Save**.
 
-1. Create a YAML file with the following contents (the instructions ask the
-   cluster to request the FUSE device for each workspace):
+1. Create a
+   [workspace configuration file](../../workspaces/workspace-templates/templates.md)
+   that includes instructions for resource requests and resource limits (the
+   instructions ask the cluster to request the FUSE device for each workspace):
 
    ```yaml
    version: "0.2"
    workspace:
-       configure:
-           start:
-               policy: write
-       dev-urls:
-           policy: write
-       specs:
-           aws-ec2-docker:
-               container-image:
-                   policy: write
-               disk-size:
-                   policy: write
-               instance-type:
-                   policy: write
-           docker:
-               container-based-vm:
-                   policy: write
-               image:
-                   policy: write
-           kubernetes:
-               annotations:
-                   policy: read
-               container-based-vm:
-                   policy: write
-               cpu:
-                   policy: write
-               disk:
-                   policy: write
-               env:
-                   policy: write
-               gpu-count:
-                   policy: write
-               image:
-                   policy: write
-               labels:
-                   policy: read
-               memory:
-                   policy: write
-               node-selector:
-                   policy: read
-               privileged:
-                   policy: read
-               resource-requests:
-                policy: write
-                value:
-                   smarter-devices/fuse: "1"
-               resource-limits:
-                policy: write
-                value:
-                   smarter-devices/fuse: "1"
-               runtime-class-name:
-                   policy: read
-               tolerations:
-                   policy: read
+     specs:
+       kubernetes:
+         resource-requests:
+           policy: write
+           value:
+             smarter-devices/fuse: "1"
+         resource-limits:
+           policy: write
+           value:
+             smarter-devices/fuse: "1"
+   ```
+
+   A complete workspace template might look something like
+
+   ```yaml
+   version: "0.2"
+   workspace:
+     configure:
+       start:
+         policy: write
+     dev-urls:
+       policy: write
+     specs:
+       aws-ec2-docker:
+         container-image:
+           policy: write
+         disk-size:
+           policy: write
+         instance-type:
+           policy: write
+       docker:
+         container-based-vm:
+           policy: write
+         image:
+           policy: write
+       kubernetes:
+         annotations:
+           policy: read
+         container-based-vm:
+           policy: write
+         cpu:
+           policy: write
+         disk:
+           policy: write
+         env:
+           policy: write
+         gpu-count:
+           policy: write
+         image:
+           policy: write
+         labels:
+           policy: read
+         memory:
+           policy: write
+         node-selector:
+           policy: read
+         privileged:
+           policy: read
+         resource-requests:
+           policy: write
+           value:
+             smarter-devices/fuse: "1"
+         resource-limits:
+           policy: write
+           value:
+             smarter-devices/fuse: "1"
+         runtime-class-name:
+           policy: read
+         tolerations:
+           policy: read
    ```
 
 1. In the Coder UI, navigate to **Manage** > **Admin** > **Templates** if you
    haven't already done so. Under **template policy**, upload the configuration
    file you created in the previous step. Click **Save**.
 
-1. If you have SELinux and AppArmor enabled, please disable both.
+   With the above template policy, all workspaces will acquire a FUSE device,
+   which enables Podman to operate in rootless mode.
+
+## For systems running AppArmor and SELinux
+
+Running Podman in rootless mode requires a FUSE device to implement the overlay
+filesystem (fuse-overlayfs) in unprivileged mode. The following directions work
+by mounting the FUSE device from the host into workspace containers, which
+conflicts with the isolation provided by SELinux and AppArmor.
+
+For systems running AppArmor (typically Debian- and Ubuntu-derived systems),
+please disable AppArmor before proceeding.
+
+For systems running SELinux (typically Fedora-, CentOS-, and Red Hat-based
+systems), please disable SELinux or set it to `permissive` mode.
 
 ## Testing
 
 At this point, you can create a workspace that leverages Podman. If you need a
 sample Podman image, you can obtain one
 [from RedHat](https://quay.io/repository/podman/stable?tag=latest&tab=tags).
+When using this image, switch to the unprivileged `podman` user before creating
+containers to ensure that `podman` runs in rootless mode.
