Apply a Profile to a Pod

AppArmor profiles are specified per-container.

Prerequisites

To specify the AppArmor profile to run a Pod container with, add an annotation to the Pod’s metadata:

container.apparmor.security.beta.kubernetes.io/<container_name>: <profile_ref>

Example

  1. Attach a profile to a container in the Pod.

    $ vi test-apparmor.yaml
    apiVersion: v1
    kind: Pod
    metadata:
      name: test-apparmor
      annotations:
        # Tell Kubernetes to apply the AppArmor profile "test-profile".
        container.apparmor.security.beta.kubernetes.io/test-apparmor: localhost/test-profile
    spec:
      containers:
      - name: test-apparmor
        image: busybox:1.28
        command: [ "sh", "-c", "echo 'Hello Test AppArmor!' && sleep 1h" ]
    
    $ kubectl apply -f test-apparmor.yaml
    
  2. Verify that the container is actually running with that profile by checking its proc attr.

    $ kubectl exec test-apparmor -- cat /proc/1/attr/current
    test-profile (complain)
    
  3. Verify if violations are blocked by writing to a file.

    $ kubectl exec test-apparmor -- touch /tmp/test
            touch: /tmp/test: Permission denied
            command terminated with exit code 1
    

Note

If a profile is not created/loaded on a host, kubelet will reject the pod.

$ kubectl get pods
NAME               READY   STATUS                 RESTARTS      AGE
hello-apparmor     0/1     CreateContainerError   0 (49m ago)   113m

Running kubectl describe pod hello-apparmor or kubect get event | grep hello-apparmor will show the following error:

Error: : failed to generate apparmor spec opts: apparmor profile not found test-profile

Any profile rules updates are reflected to the running pods.

Any profile deletion while it is attached to a pod will not have any impact on the pod state (It will show in running state). The application in the pod may not behave correctly as it might try to access /proc/self/attr/apparmor/exec which throw error as profile is not loaded.

For more details, refer to Restrict a Container’s Access to Resources with AppArmor: Example.