From 2531ab661a34ea9f07040db965d8db5d2ffe7201 Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Sat, 11 Apr 2026 13:41:01 +0300 Subject: [PATCH] [cilium] Drop mount-bpf-fs from AppArmor unconfined annotations mount-bpf-fs runs as privileged in the vendored chart, and the Linux kernel does not apply AppArmor profiles to privileged containers. The per-container unconfined annotation for this container is a no-op and only widens the pod's admission-policy surface for no reason. Keep the four meaningful annotations (cilium-agent, clean-cilium-state, mount-cgroup, apply-sysctl-overwrites) which target unprivileged agent and init containers actually affected by the cri-containerd.apparmor.d profile. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin --- packages/system/cilium/values.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/packages/system/cilium/values.yaml b/packages/system/cilium/values.yaml index 048c4312c..4b2e1ff36 100644 --- a/packages/system/cilium/values.yaml +++ b/packages/system/cilium/values.yaml @@ -32,9 +32,10 @@ cilium: # (kubernetes/kubernetes#125069). # Safe on Talos / RHEL family without AppArmor: kubelet ignores these # annotations when the AppArmor LSM is not loaded. + # mount-bpf-fs is intentionally excluded: it runs as privileged, and the + # kernel does not apply AppArmor profiles to privileged containers. podAnnotations: container.apparmor.security.beta.kubernetes.io/cilium-agent: unconfined container.apparmor.security.beta.kubernetes.io/clean-cilium-state: unconfined container.apparmor.security.beta.kubernetes.io/mount-cgroup: unconfined container.apparmor.security.beta.kubernetes.io/apply-sysctl-overwrites: unconfined - container.apparmor.security.beta.kubernetes.io/mount-bpf-fs: unconfined