Given the following AppArmor profile and Pod manifest: AppArmor Profile: `` profile nginx-deny flags=(attach_disconnected) { #include <abstractions/base> file, # Deny all file writes. deny /** w, }…

Question

profile nginx-deny flags=(attach_disconnected) {
 #include <abstractions/base>
 file,
 # Deny all file writes.
 deny /** w,
}
EOF'

apiVersion: v1
kind: Pod
metadata:
 name: apparmor-pod
spec:
 containers:
 - name: apparmor-pod
 image: nginx

Explanation

This question tests the ability to apply a pre-loaded AppArmor profile to a Kubernetes Pod via manifest annotation, then verify the kernel-level restriction is enforced inside the running container.

Approach. First, ensure the AppArmor profile 'nginx-deny' is loaded on the node using apparmor_parser -q /path/to/profile. Next, edit the Pod manifest to add the annotation container.apparmor.security.beta.kubernetes.io/apparmor-pod: localhost/nginx-deny under metadata.annotations - the annotation key suffix must exactly match the container name. Apply with kubectl apply -f <manifest.yaml>, then verify enforcement by running kubectl exec apparmor-pod -- touch /tmp/testfile; the write should be denied with 'Permission denied' because the profile contains deny /** w, which blocks all file writes system-wide inside the container.

Concept tested. Applying AppArmor profiles to Kubernetes Pods using metadata annotations (container.apparmor.security.beta.kubernetes.io/<container-name>: localhost/<profile-name>) to enforce kernel-level mandatory access control - a core CKS (Certified Kubernetes Security Specialist) objective covering container sandboxing and runtime security hardening.

Reference. https://kubernetes.io/docs/tutorials/security/apparmor/

No community discussion yet for this question.