kubelet-service: narrow down restorecon path

Previously the `restorecon` command was applies on /var/lib/kubelet/
This caused the command to hang forever on a stale NFS volumes.

To minimize the affect of the command this command suggest few things:
1. Narrowing down the path so the command will take affect only for the concrete use case we aware of,
where pod-resources changes its label due to: containers/container-selinux#329

2. Add the `i` flag which ignores the path if it doesn't exist.
This is done to make sure we're not failing the service
in case of missing path.

3. Remove the `v` flag to minimize logging pressure under the node.

Signed-off-by: Talor Itzhak <[email protected]>

Author: Tal-or

templates/master/01-master-kubelet/_base/units/kubelet.service.yaml

@@ -10,7 +10,7 @@ contents: |
   [Service]
   Type=notify
   ExecStartPre=/bin/mkdir --parents /etc/kubernetes/manifests
-  ExecStartPre=-/usr/sbin/restorecon -rv /var/lib/kubelet/ /usr/local/bin/kubenswrapper /usr/bin/kubensenter
+  ExecStartPre=-/usr/sbin/restorecon -ri /var/lib/kubelet/pod-resources /usr/local/bin/kubenswrapper /usr/bin/kubensenter
 {{- if eq .IPFamilies "IPv6"}}
   Environment="KUBELET_NODE_IP=::"
 {{- else}}

templates/master/01-master-kubelet/on-prem/units/kubelet.service.yaml

@@ -10,7 +10,7 @@ contents: |
   [Service]
   Type=notify
   ExecStartPre=/bin/mkdir --parents /etc/kubernetes/manifests
-  ExecStartPre=-/usr/sbin/restorecon -rv /var/lib/kubelet/ /usr/local/bin/kubenswrapper /usr/bin/kubensenter
+  ExecStartPre=-/usr/sbin/restorecon -ri /var/lib/kubelet/pod-resources /usr/local/bin/kubenswrapper /usr/bin/kubensenter
 {{- if eq .IPFamilies "IPv6"}}
   Environment="KUBELET_NODE_IP=::"
 {{- else}}

templates/worker/01-worker-kubelet/_base/units/kubelet.service.yaml

@@ -10,7 +10,7 @@ contents: |
   [Service]
   Type=notify
   ExecStartPre=/bin/mkdir --parents /etc/kubernetes/manifests
-  ExecStartPre=-/usr/sbin/restorecon -rv /var/lib/kubelet/ /usr/local/bin/kubenswrapper /usr/bin/kubensenter
+  ExecStartPre=-/usr/sbin/restorecon -ri /var/lib/kubelet/pod-resources /usr/local/bin/kubenswrapper /usr/bin/kubensenter
 {{- if eq .IPFamilies "IPv6"}}
   Environment="KUBELET_NODE_IP=::"
 {{- else}}

templates/worker/01-worker-kubelet/on-prem/units/kubelet.service.yaml

@@ -10,7 +10,7 @@ contents: |
   [Service]
   Type=notify
   ExecStartPre=/bin/mkdir --parents /etc/kubernetes/manifests
-  ExecStartPre=-/usr/sbin/restorecon -rv /var/lib/kubelet/ /usr/local/bin/kubenswrapper /usr/bin/kubensenter
+  ExecStartPre=-/usr/sbin/restorecon -ri /var/lib/kubelet/pod-resources /usr/local/bin/kubenswrapper /usr/bin/kubensenter
 {{- if eq .IPFamilies "IPv6"}}
   Environment="KUBELET_NODE_IP=::"
 {{- else}}