Mastering Kubernetes - Second Edition

Securing a pod with AppArmor

As AppArmor is still in beta, you specify the metadata as annotations and not as bonafide fields; when it gets out of beta that will change.

To apply a profile to a container, add the following annotation:

container.apparmor.security.beta.kubernetes.io/<container-name>: <profile-ref>

The pofile reference can be either the default profile, runtime/default, or a profile file on the host localhost/<profile-name>.

Here is a sample profile that prevents writing to files:

#include <tunables/global> 
 
profile k8s-apparmor-example-deny-write flags=(attach_disconnected) { 
  #include <abstractions/base> 
 
  file, 
 
  # Deny all file writes. 
  deny /** w, 
} 

AppArmor is not a Kubernetes resource, so the format is not the YAML or JSON ...