@@ -2,9 +2,11 @@ package kubernetes

 import (

 	"crypto/tls"

+	"fmt"

 	"net"

 	"net/http"

 	"os"

+	"os/exec"

 	"path/filepath"

 	"reflect"

 	"strconv"

@@ -17,7 +19,7 @@ import (

 	"github.com/GoogleCloudPlatform/kubernetes/pkg/proxy"

 	pconfig "github.com/GoogleCloudPlatform/kubernetes/pkg/proxy/config"

 	"github.com/GoogleCloudPlatform/kubernetes/pkg/util"

-	"github.com/GoogleCloudPlatform/kubernetes/pkg/util/exec"

+	kexec "github.com/GoogleCloudPlatform/kubernetes/pkg/util/exec"

 	"github.com/GoogleCloudPlatform/kubernetes/pkg/util/iptables"

 	"github.com/fsouza/go-dockerclient"

@@ -36,6 +38,22 @@ const NodeScheme = "http"

 // NodePort is the default Kubelet port for serving information about the node.

 const NodePort = 10250

+type commandExecutor interface {

+	LookPath(executable string) (string, error)

+	Run(command string, args ...string) error

+}

+

+type defaultCommandExecutor struct{}

+

+func (ce defaultCommandExecutor) LookPath(executable string) (string, error) {

+	return exec.LookPath(executable)

+}

+

+func (ce defaultCommandExecutor) Run(command string, args ...string) error {

+	c := exec.Command(command, args...)

+	return c.Run()

+}

+

 // NodeConfig represents the required parameters to start the OpenShift node

 // through Kubernetes. All fields are required.

 type NodeConfig struct {

@@ -80,17 +98,32 @@ func (c *NodeConfig) EnsureDocker(docker *dockerutil.Helper) {

 // an absolute path and create the directory if it does not exist. Will exit if

 // an error is encountered.

 func (c *NodeConfig) EnsureVolumeDir() {

-	rootDirectory, err := filepath.Abs(c.VolumeDir)

+	if volumeDir, err := c.initializeVolumeDir(&defaultCommandExecutor{}, c.VolumeDir); err != nil {

+		glog.Fatal(err)

+	} else {

+		c.VolumeDir = volumeDir

+	}

+}

+

+func (c *NodeConfig) initializeVolumeDir(ce commandExecutor, path string) (string, error) {

+	rootDirectory, err := filepath.Abs(path)

 	if err != nil {

-		glog.Fatalf("Error converting volume directory to an absolute path: %v", err)

+		return "", fmt.Errorf("Error converting volume directory to an absolute path: %v", err)

 	}

 	if _, err := os.Stat(rootDirectory); os.IsNotExist(err) {

 		if mkdirErr := os.MkdirAll(rootDirectory, 0750); mkdirErr != nil {

-			glog.Fatalf("Couldn't create kubelet volume root directory '%s': %s", rootDirectory, mkdirErr)

+			return "", fmt.Errorf("Couldn't create kubelet volume root directory '%s': %s", rootDirectory, mkdirErr)

+		}

+		if chconPath, chconLookupErr := ce.LookPath("chcon"); chconLookupErr != nil {

+			glog.V(2).Infof("Couldn't locate 'chcon' to set the kubelet volume root directory context: %s", chconLookupErr)

+		} else {

+			if err := ce.Run(chconPath, "-t", "svirt_sandbox_file_t", rootDirectory); err != nil {

+				return "", fmt.Errorf("Error running 'chcon' to set the kubelet volume root directory context: %s", err)

+			}

 		}

 	}

-	c.VolumeDir = rootDirectory

+	return rootDirectory, nil

 }

 // RunKubelet starts the Kubelet.

@@ -192,7 +225,7 @@ func (c *NodeConfig) RunProxy() {

 	}

 	var proxier pconfig.ServiceConfigHandler

-	proxier = proxy.NewProxier(loadBalancer, ip, iptables.New(exec.New(), protocol))

+	proxier = proxy.NewProxier(loadBalancer, ip, iptables.New(kexec.New(), protocol))

 	if proxier == nil || reflect.ValueOf(proxier).IsNil() { // explicitly declared interfaces aren't plain nil, you must reflect inside to see if it's really nil or not

 		glog.Errorf("WARNING: Could not modify iptables.  iptables must be mutable by this process to use services.  Do you have root permissions?")

 		proxier = &service.FailingServiceConfigProxy{}

new file mode 100644

@@ -0,0 +1,95 @@

+package kubernetes

+

+import (

+	"errors"

+	"io/ioutil"

+	"os"

+	"path"

+)

+

+import "testing"

+

+type fakeCommandExecutor struct {

+	commandFound bool

+	commandErr   error

+	runCalled    bool

+	lookCalled   bool

+}

+

+func (f *fakeCommandExecutor) LookPath(path string) (string, error) {

+	f.lookCalled = true

+	if f.commandFound {

+		return path, nil

+	}

+	return "", errors.New("not found")

+}

+

+func (f *fakeCommandExecutor) Run(command string, args ...string) error {

+	f.runCalled = true

+	return f.commandErr

+}

+

+func TestInitializeVolumeDir(t *testing.T) {

+	parentDir, err := ioutil.TempDir("", "")

+	if err != nil {

+		t.Fatalf("Unable to create parent temp dir: %s", err)

+	}

+	if err := os.MkdirAll(parentDir, 0750); err != nil {

+		t.Fatalf("Error creating volume parent dir: %s", err)

+	}

+	defer os.RemoveAll(parentDir)

+

+	testCases := []struct {

+		chconFound      bool

+		chconRunErr     error

+		removeVolumeDir bool

+	}{

+		{chconFound: false, removeVolumeDir: true},

+		{chconFound: true, chconRunErr: nil, removeVolumeDir: true},

+		{chconFound: true, chconRunErr: errors.New("e"), removeVolumeDir: true},

+		{removeVolumeDir: false},

+	}

+

+	for i, testCase := range testCases {

+		ce := &fakeCommandExecutor{

+			commandFound: testCase.chconFound,

+			commandErr:   testCase.chconRunErr,

+		}

+		nc := &NodeConfig{VolumeDir: path.Join(parentDir, "somedir")}

+

+		if testCase.removeVolumeDir {

+			if err := os.RemoveAll(nc.VolumeDir); err != nil {

+				t.Fatalf("%d: Error removing volume dir: %s", i, err)

+			}

+		}

+

+		path, err := nc.initializeVolumeDir(ce, nc.VolumeDir)

+

+		if testCase.removeVolumeDir {

+			if !ce.lookCalled {

+				t.Fatalf("%d: expected look for chcon", i)

+			}

+			if !testCase.chconFound && ce.runCalled {

+				t.Fatalf("%d: unexpected run after chcon not found", i)

+			}

+			if testCase.chconFound && !ce.runCalled {

+				t.Fatalf("%d: expected chcon run", i)

+			}

+			haveErr := err != nil

+			expectErr := testCase.chconRunErr != nil

+			if expectErr != haveErr {

+				t.Fatalf("%d: expected chcon run err: %t, got: %t, %s", i, expectErr, haveErr, err)

+			}

+			if !haveErr && path != nc.VolumeDir {

+				t.Fatalf("%d:, expected path(%s) == nc.VolumeDir(%s)", i, path, nc.VolumeDir)

+			}

+		} else {

+			if ce.lookCalled {

+				t.Fatalf("%d: unexpected look for chcon with reused volume dir", i)

+			}

+			if ce.runCalled {

+				t.Fatalf("%d: unexpected run for chcon with reused volume dir", i)

+			}

+		}

+	}

+}