AppArmor design proposal #29168
AppArmor design proposal #29168
Conversation
docs/proposals/apparmor.md
Outdated
There was a problem hiding this comment.
this is a good route, because doing the "install" of the profile is an ugly exec of apparmor_parser ;) best just to leave it to the admin so yay
There was a problem hiding this comment.
Ack. I'm guessing that building a solution for deploying profiles will be high priority though, even if it doesn't make the alpha feature list...
|
/cc @kubernetes/goog-image FYI |
|
Do you have any guidelines for users on how to provision K8s nodes with AppArmor profiles(e.g., how to bring the profiles on to the nodes, and how to apply them before Kubelet can start their containers)? |
I was considering this problem to be out of the scope for alpha, but can reconsider if you think otherwise. Users may end up building the solution proposed in deploying profiles anyway, so it might be best to offer it as an "unofficial" (a.k.a. pre-alpha) option. |
|
After several conversations in other channels, I decided that it would be helpful to provide a reference implementation for loading profiles onto nodes. I've added a section describing the approach, as well as a testing plan. PTAL |
|
LGTM, the new stuff with getting profiles on the nodes as well :) |
|
Thanks! Adding LGTM label. |
|
Squashed & rebased. |
|
Reran |
|
Apparantly the munger was using my alternate gopath as ustream. Fixed & reran. |
|
GCE e2e build/test passed for commit 55c39b9. |
|
Automatic merge from submit-queue |
For kubernetes/enhancements#24
/cc @kubernetes/sig-node @erictune @matchstick