admin/cozystack
1
0 Fork 0
mirror of https://github.com/cozystack/cozystack.git synced 2026-11-09 05:25:14 +09:00
Code Issues Packages Projects Releases Wiki Activity

[cilium] Drop mount-bpf-fs from AppArmor unconfined annotations

Browse Source 
mount-bpf-fs runs as privileged in the vendored chart, and the Linux
kernel does not apply AppArmor profiles to privileged containers. The
per-container unconfined annotation for this container is a no-op and
only widens the pod's admission-policy surface for no reason.

Keep the four meaningful annotations (cilium-agent, clean-cilium-state,
mount-cgroup, apply-sysctl-overwrites) which target unprivileged agent
and init containers actually affected by the cri-containerd.apparmor.d
profile.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
(cherry picked from commit 2531ab661a)
This commit is contained in:
Aleksei Sviridkin authored and github-actions[bot] committed 2026-04-12 09:32:15 +00:00
1 parent 06dce029c9
commit 5bf0112bed
1 file changed
+2 -1
Download Patch File Download Diff File Expand all files Collapse all files
packages/system/cilium/values.yaml
+2 -1
View File
@@ -32,9 +32,10 @@ cilium:
# (kubernetes/kubernetes#125069).
# Safe on Talos / RHEL family without AppArmor: kubelet ignores these
# annotations when the AppArmor LSM is not loaded.
# mount-bpf-fs is intentionally excluded: it runs as privileged, and the
# kernel does not apply AppArmor profiles to privileged containers.
podAnnotations:
container.apparmor.security.beta.kubernetes.io/cilium-agent: unconfined
container.apparmor.security.beta.kubernetes.io/clean-cilium-state: unconfined
container.apparmor.security.beta.kubernetes.io/mount-cgroup: unconfined
container.apparmor.security.beta.kubernetes.io/apply-sysctl-overwrites: unconfined
container.apparmor.security.beta.kubernetes.io/mount-bpf-fs: unconfined