Add AppArmor Annotations

In the earlier Pod Security Policy controller, it was possible to define a setting which would enable AppArmor for all the containers within a Pod so they may be assigned the desired profile. Assigning an AppArmor profile, accomplished via an annotation, is useful in that it allows secure defaults to be defined and may also result in passing other validation rules such as those in the Pod Security Standards. This policy mutates Pods to add an annotation for every container to enabled AppArmor at the runtime/default level.

View on GitHub

Policy Definition

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: add-apparmor-annotations
  annotations:
    policies.kyverno.io/title: Add AppArmor Annotations
    policies.kyverno.io/category: PSP Migration
    policies.kyverno.io/subject: Pod,Annotation
    kyverno.io/kyverno-version: 1.10.0
    kyverno.io/kubernetes-version: "1.24"
    pod-policies.kyverno.io/autogen-controllers: none
    policies.kyverno.io/description: In the earlier Pod Security Policy controller, it was possible to define a setting which would enable AppArmor for all the containers within a Pod so they may be assigned the desired profile. Assigning an AppArmor profile, accomplished via an annotation, is useful in that it allows secure defaults to be defined and may also result in passing other validation rules such as those in the Pod Security Standards. This policy mutates Pods to add an annotation for every container to enabled AppArmor at the runtime/default level.
spec:
  rules:
    - name: apparmor-runtime-default
      match:
        any:
          - resources:
              kinds:
                - Pod
      preconditions:
        all:
          - key: "{{request.operation || 'BACKGROUND'}}"
            operator: AnyIn
            value:
              - CREATE
              - UPDATE
      mutate:
        foreach:
          - list: request.object.spec.[ephemeralContainers, initContainers, containers][]
            patchStrategicMerge:
              metadata:
                annotations:
                  container.apparmor.security.beta.kubernetes.io/{{element.name}}: runtime/default

Related Policies

MutateMedium

Add Safe To Evict

The Kubernetes cluster autoscaler does not evict pods that use hostPath or emptyDir volumes. To allow eviction of these pods, the annotation cluster-autoscaler.kubernetes.io/safe-to-evict=true must be added to the pods.

Pod

MutateMedium

Add Safe To Evict

Pod

ValidateMedium

Require Read-Only Root Filesystem

A read-only root file system helps to enforce an immutable infrastructure strategy; the container only needs to write on the mounted volume that persists the state. An immutable root filesystem can also prevent malicious binaries from writing to the host system. This policy validates that containers define a securityContext with `readOnlyRootFilesystem: true`.

Pod