github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Remove check for apparmor_parser in AppArmor host validation

Browse Source 
The `apparmor_parser` binary is not really required for a system to run
AppArmor from a Kubernetes perspective. How to apply the profile is more
in the responsibility of lower level runtimes like CRI-O and containerd,
which may do the binary check on their own.

This synchronizes the current libcontainer implementation with the
vendored Kubernetes source code and allows distributions to use
AppArmor, even when they do not have the parser available in
`/sbin/apparmor_parser`.

Signed-off-by: Sascha Grunert <mail@saschagrunert.de>
This commit is contained in:
Sascha Grunert
2021-01-12 14:36:17 +01:00
committed by Sascha Grunert
parent 5404b5a28a
commit 0d22571519
2 changed files with 5 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
test/e2e_node/apparmor_test.go
View File

@@ -27,7 +27,8 @@ import (
"strconv"
"strings"
"k8s.io/api/core/v1"
"github.com/opencontainers/runc/libcontainer/apparmor"
v1 "k8s.io/api/core/v1"
apierrors "k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/fields"
@@ -37,7 +38,6 @@ import (
"k8s.io/client-go/tools/cache"
watchtools "k8s.io/client-go/tools/watch"
"k8s.io/klog/v2"
"k8s.io/kubernetes/pkg/security/apparmor"
"k8s.io/kubernetes/test/e2e/framework"
e2epod "k8s.io/kubernetes/test/e2e/framework/pod"
@@ -246,5 +246,5 @@ func isAppArmorEnabled() bool {
if strings.Contains(framework.TestContext.NodeName, "-ubuntu-") {
return true
}
return apparmor.IsAppArmorEnabled()
return apparmor.IsEnabled()
}