2 AppArmor and Kubernetes

John Johansen edited this page 2021-09-22 21:34:11 +00:00

Unescape Escape

Table of Contents

• Kubernetes and AppArmor
• Setting a profile to complain/learning mode
• Testing
• Load the example AppArmor profile:
• Create the K8s Pod:
• Verify the new Pod named hello-restricted is running:
• Verify that the Pod is enforcing the AppArmor profile k8s-deny-write:
• Verify that file writes are being denied inside the Pod’s container:

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

Kubernetes and AppArmor

In Kubernetes (K8s) and MicroK8s, AppArmor profiles are specified in the Pod configuration file. A Pod is a group of one or more containers and represents the smallest deployable unit within K8s. The AppArmor profile is enforced on all processes running in the Pod’s containers, and if no profile is specified, the Pod will use the default profile for the container. Container Profiles

Docker automatically loads the profile docker-default from a tmp file that does not persist on disk. MicroK8s loads the profile cri-containerd.apparmor.d for containerd and installs it to /etc/apparmor.d. The latest version of this profile can be seen here:

Setting a profile to complain/learning mode

There are two ways to set a profile in complain mode. Using the system tool aa-complain

sudo aa-complain /etc/apparmor.d/profile.to.set.in.complain.mode

and manually editing the profile file, by adding the complain flag

eg.

profile example {
   # some rules
   # ...
}

ad the flag profile flag complain

profile flags=(complain) {
   # some rules
   # ...
}

and then manually reload the profile

sudo apparmor_parser -r /etc/apparmor.d/example.profile

Testing

Below is an example AppArmor profile to deny all file writes, k8s-deny-write:

#include <tunables/global>
profile k8s-deny-write flags=(attach_disconnected) {
  #include <abstractions/base>
  file,
  # Deny all file writes.
  deny /** w,
}

This profile must be loaded on the K8s Node (a physical or virtual machine) that will be running the Pod.

Below is an example K8s Pod configuration file, hello-restricted.yaml:

apiVersion: v1
kind: Pod
metadata:
  name: hello-restricted
  annotations:
    container.apparmor.security.beta.kubernetes.io/hello: localhost/k8s-deny-write
spec:
  containers:
  - name: hello
    image: busybox
    command: [ "sh", "-c", "echo 'Hello AppArmor!' && sleep 1h" ]

The metadata annotation tells K8s to use the AppArmor profile defined above and creates a simple pod to use for inspection. The following commands are provided for a MicroK8s installation. To test these examples on a regular K8s cluster, remove microk8s from the commands.

Load the example AppArmor profile:

sudo apparmor_parser ./k8s-deny-write

Create the K8s Pod:

microk8s kubectl create -f ./hello-restricted.yaml

Verify the new Pod named hello-restricted is running:

microk8s kubectl get pods

Verify that the Pod is enforcing the AppArmor profile k8s-deny-write:

microk8s kubectl exec hello-restricted -- cat /proc/1/attr/current

Verify that file writes are being denied inside the Pod’s container:

microk8s kubectl exec hello-restricted -- touch /tmp/testfile