[PodSecurity] baseline - apparmor #103378

n4j · 2021-06-30T18:03:40Z

What type of PR is this?

/kind feature

What this PR does / why we need it:

Implement the "AppArmor" check from https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline

Disallows containers and initContainers with uncofined AppArmor annotation

Which issue(s) this PR fixes:

Fixes #103200

Special notes for your reviewer:

NONE

Does this PR introduce a user-facing change?

NONE

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

- [KEP]: https://github.com/kubernetes/enhancements/tree/master/keps/sig-auth/2579-psp-replacement

k8s-ci-robot · 2021-06-30T18:03:47Z

@n4j: This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-ci-robot · 2021-06-30T18:03:48Z

Hi @n4j. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

n4j · 2021-06-30T18:04:17Z

/assign @tallclair @liggitt

liggitt · 2021-06-30T18:05:03Z

@tallclair will take lead reviewing this one

liggitt · 2021-06-30T18:05:17Z

/ok-to-test

tallclair

Thanks for picking this up!

staging/src/k8s.io/pod-security-admission/policy/check_apparmor.go

staging/src/k8s.io/pod-security-admission/test/fixtures_apparmor.go

n4j · 2021-06-30T19:22:23Z

@tallclair Thanks for the PR comments :)

Can you please re-review?

staging/src/k8s.io/pod-security-admission/policy/check_apparmor.go

staging/src/k8s.io/pod-security-admission/test/fixtures_apparmor.go

liggitt · 2021-07-01T15:40:54Z

looks good, just a couple tweaks to the test fixtures (don't forget to regenerate fixtures and squash after making the updates)

n4j · 2021-07-01T17:19:45Z

/test pull-kubernetes-integration

liggitt · 2021-07-01T17:46:03Z

pkg/security/podsecuritypolicy/sysctl/mustmatchpatterns.go

@@ -35,6 +35,7 @@ func SafeSysctlWhitelist() []string {
 		"net.ipv4.ip_local_port_range",
 		"net.ipv4.tcp_syncookies",
 		"net.ipv4.ping_group_range",
+		"net.ipv4.ip_unprivileged_port_start",


I'm surprised to see this... bad rebase?

Yes, give me a moment to fix this

Implement the "AppArmor" check from https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline - AppArmor check - Fixtures - UnitTest case

n4j · 2021-07-01T18:08:22Z

Raised #103412 due to bad rebase issues

tallclair · 2021-07-01T18:55:05Z

@n4j I'd prefer to keep this PR open to maintain the comment history. Ping me on slack if you want, and i can help you resolve the rebase issues. If #103412 has what you want, the following should work:

git checkout feature/podSecurityApparmor_v2
git reset --hard feature/appArmor_v3
git push -f origin feature/podSecurityApparmor_v2

n4j · 2021-07-01T21:59:47Z

@tallclair / @liggitt Please re-review.

tallclair

/lgtm
/approve

Thanks!

tallclair · 2021-07-01T22:15:17Z

staging/src/k8s.io/pod-security-admission/policy/check_apparmor_test.go

+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestCheckAppArmor(t *testing.T) {


thanks for the unit test!

k8s-ci-robot · 2021-07-01T22:16:45Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: n4j, tallclair

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~staging/src/k8s.io/pod-security-admission/OWNERS~~ [tallclair]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added the needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. label Jun 30, 2021

k8s-ci-robot requested a review from deads2k June 30, 2021 18:03

k8s-ci-robot added the sig/auth Categorizes an issue or PR as relevant to SIG Auth. label Jun 30, 2021

k8s-ci-robot requested a review from krmayankk June 30, 2021 18:03

k8s-ci-robot assigned liggitt and tallclair Jun 30, 2021

n4j mentioned this pull request Jun 30, 2021

[PodSecurity] baseline - apparmor #103367

Closed

liggitt removed their assignment Jun 30, 2021

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jun 30, 2021

tallclair suggested changes Jun 30, 2021

View reviewed changes

n4j requested a review from tallclair June 30, 2021 19:21

tallclair reviewed Jun 30, 2021

View reviewed changes

liggitt reviewed Jun 30, 2021

View reviewed changes

staging/src/k8s.io/pod-security-admission/test/fixtures_apparmor.go Show resolved Hide resolved

n4j requested a review from tallclair July 1, 2021 01:47

liggitt reviewed Jul 1, 2021

View reviewed changes

staging/src/k8s.io/pod-security-admission/test/fixtures_apparmor.go Outdated Show resolved Hide resolved

liggitt self-assigned this Jul 1, 2021

n4j force-pushed the feature/podSecurityApparmor_v2 branch from 3de8300 to 1d803ed Compare July 1, 2021 16:34

n4j requested a review from liggitt July 1, 2021 16:36

k8s-ci-robot added the do-not-merge/contains-merge-commits Indicates a PR which contains merge commits. label Jul 1, 2021

liggitt reviewed Jul 1, 2021

View reviewed changes

n4j force-pushed the feature/podSecurityApparmor_v2 branch from bbb46fb to 817901d Compare July 1, 2021 17:50

k8s-ci-robot removed the do-not-merge/contains-merge-commits Indicates a PR which contains merge commits. label Jul 1, 2021

[PodSecurity] baseline - apparmor

8049448

Implement the "AppArmor" check from https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline - AppArmor check - Fixtures - UnitTest case

n4j closed this Jul 1, 2021

tallclair reopened this Jul 1, 2021

tallclair mentioned this pull request Jul 1, 2021

[PodSecurity] baseline - apparmor #103412

Closed

n4j force-pushed the feature/podSecurityApparmor_v2 branch from 817901d to 8049448 Compare July 1, 2021 21:57

n4j requested a review from liggitt July 1, 2021 22:00

tallclair approved these changes Jul 1, 2021

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 1, 2021

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 1, 2021

k8s-ci-robot merged commit 2627808 into kubernetes:master Jul 2, 2021

k8s-ci-robot added this to the v1.22 milestone Jul 2, 2021

n4j deleted the feature/podSecurityApparmor_v2 branch July 2, 2021 03:05

n4j mentioned this pull request Jul 7, 2021

REQUEST: New membership for n4j kubernetes/org#2818

Closed

6 tasks

liggitt mentioned this pull request Jul 10, 2021

PodSecurity admission (PodSecurityPolicy replacement) kubernetes/enhancements#2579

Closed

12 tasks

pacoxu mentioned this pull request Sep 10, 2021

kubectl get pods command shows status AppArmor for pod on k8s v1.22 #104888

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[PodSecurity] baseline - apparmor #103378

[PodSecurity] baseline - apparmor #103378

n4j commented Jun 30, 2021

k8s-ci-robot commented Jun 30, 2021

k8s-ci-robot commented Jun 30, 2021

n4j commented Jun 30, 2021

liggitt commented Jun 30, 2021

liggitt commented Jun 30, 2021

tallclair left a comment

n4j commented Jun 30, 2021

liggitt commented Jul 1, 2021

n4j commented Jul 1, 2021

liggitt Jul 1, 2021

n4j Jul 1, 2021

n4j commented Jul 1, 2021

tallclair commented Jul 1, 2021

n4j commented Jul 1, 2021

tallclair left a comment

tallclair Jul 1, 2021

k8s-ci-robot commented Jul 1, 2021

[PodSecurity] baseline - apparmor #103378

[PodSecurity] baseline - apparmor #103378

Conversation

n4j commented Jun 30, 2021

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

k8s-ci-robot commented Jun 30, 2021

k8s-ci-robot commented Jun 30, 2021

n4j commented Jun 30, 2021

liggitt commented Jun 30, 2021

liggitt commented Jun 30, 2021

tallclair left a comment

Choose a reason for hiding this comment

n4j commented Jun 30, 2021

liggitt commented Jul 1, 2021

n4j commented Jul 1, 2021

liggitt Jul 1, 2021

Choose a reason for hiding this comment

n4j Jul 1, 2021

Choose a reason for hiding this comment

n4j commented Jul 1, 2021

tallclair commented Jul 1, 2021

n4j commented Jul 1, 2021

tallclair left a comment

Choose a reason for hiding this comment

tallclair Jul 1, 2021

Choose a reason for hiding this comment

k8s-ci-robot commented Jul 1, 2021