Apply a Profile to a Pod¶
AppArmor profiles are specified per-container.
Prerequisites
AppArmor should be enabled on the host(s) (described in Enable/Disable AppArmor on a Host), where workloads need to be protected using AppArmor.
Security Profiles Operator (SPO) should be installed. As described in Install Security Profiles Operator (SPO).
A profile should be loaded using SPO (described in Profile Management).
To specify the AppArmor profile to run a Pod container with, add an annotation to the Pod’s metadata:
container.apparmor.security.beta.kubernetes.io/<container_name>: <profile_ref>
Example
Attach a profile to a container in the Pod.
$ vi test-apparmor.yaml apiVersion: v1 kind: Pod metadata: name: test-apparmor annotations: # Tell Kubernetes to apply the AppArmor profile "test-profile". container.apparmor.security.beta.kubernetes.io/test-apparmor: localhost/test-profile spec: containers: - name: test-apparmor image: busybox:1.28 command: [ "sh", "-c", "echo 'Hello Test AppArmor!' && sleep 1h" ] $ kubectl apply -f test-apparmor.yaml
Verify that the container is actually running with that profile by checking its proc attr.
$ kubectl exec test-apparmor -- cat /proc/1/attr/current test-profile (complain)
Verify if violations are blocked by writing to a file.
$ kubectl exec test-apparmor -- touch /tmp/test touch: /tmp/test: Permission denied command terminated with exit code 1
Note
If a profile is not created/loaded on a host, kubelet
will reject the
pod.
$ kubectl get pods
NAME READY STATUS RESTARTS AGE
hello-apparmor 0/1 CreateContainerError 0 (49m ago) 113m
Running kubectl describe pod hello-apparmor
or
kubect get event | grep hello-apparmor
will show the following error:
Error: : failed to generate apparmor spec opts: apparmor profile not found test-profile
Any profile rules updates are reflected to the running pods.
Any profile deletion while it is attached to a pod will not have any impact
on the pod state (It will show in running state). The application in the
pod may not behave correctly as it might try to access
/proc/self/attr/apparmor/exec
which throw error as profile is not
loaded.
For more details, refer to Restrict a Container’s Access to Resources with AppArmor: Example.