Enhancements: Add AppArmor support

Created on 14 Jul 2016  ·  59Comments  ·  Source: kubernetes/enhancements

Description

Add AppArmor support to Kubernetes. Initial support should include the ability to specify an AppArmor profile for a container or pod in the API, and have that profile applied by the container runtime.

Progress Tracker

_FEATURE_STATUS is used for feature tracking and to be updated by @kubernetes/feature-reviewers._
FEATURE_STATUS: BETA

More advice:

Design

Coding

  • Use as many PRs as you need. Write tests in the same or different PRs, as is convenient for you.
  • As each PR is merged, add a comment to this issue referencing the PRs. Code goes in the http://github.com/kubernetes/kubernetes repository,
    and sometimes http://github.com/kubernetes/contrib, or other repos.
  • When you are done with the code, apply the "code-complete" label.
  • When the feature has user docs, please add a comment mentioning @kubernetes/feature-reviewers and they will
    check that the code matches the proposed feature and design, and that everything is done, and that there is adequate
    testing. They won't do detailed code review: that already happened when your PRs were reviewed.
    When that is done, you can check this box and the reviewer will apply the "code-complete" label.

Docs

  • [x] Write user docs and get them merged in.
  • User docs go into http://github.com/kubernetes/kubernetes.github.io.
  • When the feature has user docs, please add a comment mentioning @kubernetes/docs.
  • When you get LGTM, you can check this checkbox, and the reviewer will apply the "docs-complete" label.
kinfeature prioritbacklog sinode stagstable trackeno
Source
picture timstclair
👍1

All 59 comments

Original issue here: https://github.com/kubernetes/kubernetes/issues/22159

timstclair picture timstclair on 14 Jul 2016

@timstclair it looks like the docs PR number is outdated. Please update the PR number and check the docs box once it's done

janetkuo picture janetkuo on 2 Sep 2016

Fixed. Thanks @janetkuo !

timstclair picture timstclair on 2 Sep 2016

Docs https://github.com/kubernetes/kubernetes.github.io/pull/1147 - @kubernetes/docs

timstclair picture timstclair on 21 Sep 2016

Is there an issue? I merged this one in last week.

On Sep 21, 2016 1:30 PM, "Tim St. Clair" [email protected] wrote:

Docs kubernetes/kubernetes.github.io#1147
https://github.com/kubernetes/kubernetes.github.io/pull/1147 -
@kubernetes/docs https://github.com/orgs/kubernetes/teams/docs

—
You are receiving this because you are on a team that was mentioned.
Reply to this email directly, view it on GitHub
https://github.com/kubernetes/features/issues/24#issuecomment-248733477,
or mute the thread
https://github.com/notifications/unsubscribe-auth/ARmNwOTArylXQHoAoz2lMTsKhg9luaTYks5qsZPlgaJpZM4JMBOR
.

devin-donnelly picture devin-donnelly on 21 Sep 2016

No, I was just following the instructions at the bottom of the issue, which I hadn't done before...

timstclair picture timstclair on 21 Sep 2016

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

Prevent issues from auto-closing with an /lifecycle frozen comment.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or @fejta.
/lifecycle stale

fejta-bot picture fejta-bot on 2 Jan 2018

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten
/remove-lifecycle stale

fejta-bot picture fejta-bot on 7 Feb 2018

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

fejta-bot picture fejta-bot on 9 Mar 2018

/remove-lifecycle rotten

liggitt picture liggitt on 15 Mar 2018

@tallclair @liggitt
Any plans for this in 1.11?

If so, can you please ensure the feature is up-to-date with the appropriate:

  • Description
  • Milestone
  • Assignee(s)
  • Labels:

    • stage/{alpha,beta,stable}

    • sig/*

    • kind/feature

cc @idvoretskyi

justaugustus picture justaugustus on 17 Apr 2018
👍1

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

fejta-bot picture fejta-bot on 16 Jul 2018

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

fejta-bot picture fejta-bot on 15 Aug 2018

@tallclair @kubernetes/sig-node-feature-requests @kubernetes/sig-auth-feature-requests -- are there plans for AppArmor support?

/kind feature
/sig auth
/unassign @timstclair
/assign @tallclair

justaugustus picture justaugustus on 21 Aug 2018

No plans right now.

tallclair picture tallclair on 21 Aug 2018
👍1

Hi
This enhancement has been tracked before, so we'd like to check in and see if there are any plans for this to graduate stages in Kubernetes 1.13. This release is targeted to be more ‘stable’ and will have an aggressive timeline. Please only include this enhancement if there is a high level of confidence it will meet the following deadlines:

  • Docs (open placeholder PRs): 11/8
  • Code Slush: 11/9
  • Code Freeze Begins: 11/15
  • Docs Complete and Reviewed: 11/27

Please take a moment to update the milestones on your original post for future tracking and ping @kacole2 if it needs to be included in the 1.13 Enhancements Tracking Sheet

Thanks!

kacole2 picture kacole2 on 8 Oct 2018

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

fejta-bot picture fejta-bot on 6 Jan 2019

Enhancement issues opened in kubernetes/enhancements should never be marked as frozen.
Enhancement Owners can ensure that enhancements stay fresh by consistently updating their states across release cycles.

/remove-lifecycle frozen

fejta-bot picture fejta-bot on 16 Jan 2019

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

fejta-bot picture fejta-bot on 15 Feb 2019

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

fejta-bot picture fejta-bot on 17 Mar 2019

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-ci-robot picture k8s-ci-robot on 17 Mar 2019

/remove-lifecycle rotten

tallclair picture tallclair on 18 Mar 2019

It might be useful to mark this feature as rotten, as it's been stuck in beta for too long, but IMO enhancements that have been merged into kubernetes should not be closed unless they are completed (GA) or deprecated & removed.

tallclair picture tallclair on 18 Mar 2019
👍1

@tallclair anything happening here for 1.16? Any plans for deprecation?

kacole2 picture kacole2 on 9 Jul 2019

I have the beginnings of a plan to bring it to GA, but it might be a stretch to get to it in 1.16. I'll try to get a proposal out by enhancements freeze though.

tallclair picture tallclair on 9 Jul 2019

@tallclair Do you think think theres going to be any activity for this in the 1.17 release?

mrbobbytables picture mrbobbytables on 29 Sep 2019

I was hoping to get this to GA alongside seccomp in v1.17, but I'm probably only going to have time to do 1 (seccomp). If anyone else is interested in picking this up, I'd be happy to provide some pointers. Otherwise, I expect GA to happen in v1.18

tallclair picture tallclair on 30 Sep 2019

Noted. Will keep tabs on the thread in case anyone picks it up. Thanks for the update!

mrbobbytables picture mrbobbytables on 30 Sep 2019

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

fejta-bot picture fejta-bot on 29 Dec 2019

/remove-lifecycle stale

saschagrunert picture saschagrunert on 7 Jan 2020

Hey 👋, is there anything we can do to move this one forward. I’d be happy to contribute to finish this one up.

saschagrunert picture saschagrunert on 7 Jan 2020

Hey @tallclair, looks like the seccomp (https://github.com/kubernetes/enhancements/issues/135) issue didn't make 1.17, will you be trying to get this one for 1.18 in parallel to that one? Maybe @saschagrunert can pitch in and help you out with that? It doesn't look like there is a KEP associated with this, although I might have missed it if there is one. To get this into the 1.18 release, we'd need to have a KEP written that included the graduation to GA criteria and the test plan.

jeremyrickard picture jeremyrickard on 7 Jan 2020

Thanks for the offer @saschagrunert I'd welcome your help on this! The first thing to do is to write a KEP. If you're interested, take a look at the Seccomp to GA KEP. Most of that should translate directly to AppArmor, with a couple small differences:

  1. The AppArmor annotation is immutable - this actually makes it a lot simpler, as we can ignore changes on pod update.
  2. The behavior of localhost profiles makes a bit more sense in the case of AppArmor, so we can probably ignore some of the concerns about wanting to deprecate that.

I'd be happy to answer questions and help review the KEP, but I won't have time to work on it directly this release cycle.

tallclair picture tallclair on 9 Jan 2020

Thanks for the offer @saschagrunert I'd welcome your help on this! The first thing to do is to write a KEP. If you're interested, take a look at the [Seccomp to GA KEP]

Alright, I took the seccomp KEP and converted it to AppArmor with taking the differences into consideration (#1444) and addressing some of the latest review notes. I took my freedom to add you as co-author if you don't mind.

saschagrunert picture saschagrunert on 10 Jan 2020

Hey @saschagrunert ( and @tallclair), assuming the KEP gets approved prior to enhancements freeze, do you think that this is something you'll accomplish during the 1.18 timeframe? Code Freeze for 1.18 will be March 5th. If you think it is, I'll go ahead and mark it as tracked for the release and get it into the milestone.

Let me know!

Thanks so much for picking this up @saschagrunert

jeremyrickard picture jeremyrickard on 10 Jan 2020

Hey @saschagrunert ( and @tallclair), assuming the KEP gets approved prior to enhancements freeze, do you think that this is something you'll accomplish during the 1.18 timeframe? Code Freeze for 1.18 will be _March 5th_. If you think it is, I'll go ahead and mark it as tracked for the release and get it into the milestone.

Let me know!

Thanks so much for picking this up @saschagrunert

Hey @jeremyrickard, let's wait for the review of the KEP. :) From my point of view I would have time for the implementation, but I'm not sure if we can get the KEP review done until enhancement freeze (Jan 28).

saschagrunert picture saschagrunert on 13 Jan 2020
👍1

Hey @saschagrunert, it looks like there hasn't been much traffic on the KEP. I wanted to check back in since we're about a week away from enhancement freeze. I'm guessing there won't be a big push before then, but please let us know!

jeremyrickard picture jeremyrickard on 22 Jan 2020

Hey, let’s skip this KEP for 1.18. :) we can easily target it for 1.19

saschagrunert picture saschagrunert on 22 Jan 2020

Awesome, thanks for the update @saschagrunert.

jeremyrickard picture jeremyrickard on 22 Jan 2020

Thanks @saschagrunert . I want to get the open questions on the Seccomp KEP sorted out before reviewing the AppArmor one, otherwise we may just end up duplicating work.

tallclair picture tallclair on 22 Jan 2020

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

fejta-bot picture fejta-bot on 22 Apr 2020

/remove-lifecycle stale

jeremyrickard picture jeremyrickard on 22 Apr 2020

Hey there @tallclair -- 1.19 Enhancements shadow here. I wanted to check in and see if you think this Enhancement will be graduating in 1.19?

In order to have this part of the release:

  1. The KEP PR must be merged in an implementable state
  2. The KEP must have test plans
  3. The KEP must have graduation criteria.

The current release schedule is:

  • Monday, April 13: Week 1 - Release cycle begins
  • Tuesday, May 19: Week 6 - Enhancements Freeze
  • Thursday, June 25: Week 11 - Code Freeze
  • Thursday, July 9: Week 14 - Docs must be completed and reviewed
  • Tuesday, August 4: Week 17 - Kubernetes v1.19.0 released
  • Thursday, August 20: Week 19 - Release Retrospective

If you do, I'll add it to the 1.19 tracking sheet (http://bit.ly/k8s-1-19-enhancements). Once coding begins please list all relevant k/k PRs in this issue so they can be tracked properly. 👍

Thanks!

msedzins picture msedzins on 28 Apr 2020

Hi there @tallclair ,

Kind reminder about my question above.

Regards,
Mirek

msedzins picture msedzins on 30 Apr 2020

/assign @saschagrunert

Are you planning to get AppArmor to GA this releases cycle?

tallclair picture tallclair on 30 Apr 2020

This KEP will not be part of 1.19 because we don’t have enough resources in SIG architecture to provide the API reviews.

saschagrunert picture saschagrunert on 1 May 2020

Thank you @saschagrunert for letting me know.

msedzins picture msedzins on 1 May 2020

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

fejta-bot picture fejta-bot on 30 Jul 2020

/remove-lifecycle stale

saschagrunert picture saschagrunert on 30 Jul 2020

Will target to work on this in v1.20.0.

saschagrunert picture saschagrunert on 20 Aug 2020
👍1

Hi @saschagrunert

Enhancements Lead here. Just to clarify this will graduate to stable in 1.20?

Thanks
Kirsten

kikisdeliveryservice picture kikisdeliveryservice on 12 Sep 2020

Hey @kikisdeliveryservice, thank you for the hint. I have to clarify with SIG Node and API Review if we can manage to get this KEP into v1.20.0.

@liggitt do you think you have some time for this one in v1.20?

saschagrunert picture saschagrunert on 14 Sep 2020
👍1

Hi @saschagrunert

Just circling back around on this. Enhancements Freeze is October 6th - do you have a better idea of whether this will make 1.20?

Thanks!
Kirsten

kikisdeliveryservice picture kikisdeliveryservice on 24 Sep 2020

Hi @kikisdeliveryservice, the KEP (https://github.com/kubernetes/enhancements/pull/1444) needs approval and probably API review. I'll check if we can make it for this cycle.

saschagrunert picture saschagrunert on 24 Sep 2020
👍1

Hi @saschagrunert

I'm going to track this for now pending the kep. I did note that the dir structure of the new kep seems to be incorrect: https://github.com/kubernetes/enhancements/pull/1444#pullrequestreview-497109187

Will keep an 👁️ on this to see if it makes it in by Enhancements Freeze, October 6th.

Best,
Kirsten

kikisdeliveryservice picture kikisdeliveryservice on 27 Sep 2020
👍1

Took a look and the PR (https://github.com/kubernetes/enhancements/pull/1444) looks good!

Just need to get this merged by next Tuesday October 6th

kikisdeliveryservice picture kikisdeliveryservice on 30 Sep 2020

@saschagrunert as a reminder your PR (#1444 ) needs to merge by EOD PST tomorrow October 6th to be included in the 1.20 Release. After that time you will need to request an exception.

kikisdeliveryservice picture kikisdeliveryservice on 5 Oct 2020

Hi @saschagrunert

Enhancements Freeze is now in effect. Unfortunately, you still have an outstanding PR that did not merge in time for the deadline. If you wish to be included in the 1.20 Release, please submit an Exception Request as soon as possible.

Best,
Kirsten
1.20 Enhancements Lead

kikisdeliveryservice picture kikisdeliveryservice on 7 Oct 2020

Yeah…let's finish this KEP review in 1.20 and target the implementation for 1.21.

saschagrunert picture saschagrunert on 7 Oct 2020
👍1
Was this page helpful?
0 / 5 - 0 ratings

Related issues

wlan0 picture wlan0  ·  9Comments
saschagrunert picture saschagrunert  ·  6Comments
justinsb picture justinsb  ·  11Comments
msau42 picture msau42  ·  13Comments
dekkagaijin picture dekkagaijin  ·  9Comments