KEP-24: Graduate Kubernetes' support for AppArmor to GA.

[vinayakankugoyal]

Update the feature gate for AppArmor to Stable stage for 1.31.

With kubernetes/kubernetes#125257 we will be graduating the AppArmor support to GA aka stable. This PR updates the docs to reflect that.

xref kubernetes/enhancements#24

[vinayakankugoyal]

/cc @tallclair

[netlify]

👷 Deploy Preview for kubernetes-io-vnext-staging processing.

Name	Link
🔨 Latest commit	87a7055
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-vnext-staging/deploys/66a18b792dc6790008b91988

[netlify]

✅ Pull request preview available for checking

Built without sensitive environment variables

Name	Link
🔨 Latest commit	87a7055
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/66a18b79dbe2b10008e722ce
😎 Deploy Preview	https://deploy-preview-47023--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[dipesh-rawat]

@vinayakankugoyal Currently, it appears that this PR is modifying the Chinese localization feature gate file, which is incorrect. This change should be applied to the 'AppArmor ' feature gate description file in English. Please make the necessary correction.

Location for file to be changed: content/en/docs/reference/command-line-tools-reference/feature-gates/apparmor.md

[dipesh-rawat]

/remove-language zh
/remove-area localization

[sftim]

Some early feedback: there are other details we expect to see covered ahead of graduation.

Please see:

• Missing documentation for apparmor.security.beta.kubernetes.io/defaultProfileName annotation key #43310
• https://kubernetes.io/docs/concepts/security/ (should mention AppArmor, or link to a page that does)
• https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/ (should mention AppArmor, or link to a page that does)
• https://kubernetes.io/docs/tutorials/ (the tutorial title in this page doesn't match the page title)
• https://kubernetes.io/docs/tutorials/security/apparmor/ (explain any clean up steps required)

and check whether https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ needs any update for GA.

[vinayakankugoyal]

Some early feedback: there are other details we expect to see covered ahead of graduation.

Please see:

• Missing documentation for apparmor.security.beta.kubernetes.io/defaultProfileName annotation key #43310

With the new field all annotation based mechanisms are considered deprecated.

• https://kubernetes.io/docs/concepts/security/ (should mention AppArmor, or link to a page that does)

That also does not mention other security controls like runAsUser, seccomp but does mention PSS. PSS already has controls for appArmor.

• https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/ (should mention AppArmor, or link to a page that does)

That also does not mention other security controls like runAsUser, seccomp but does mention PSS. PSS already has controls for appArmor.

• https://kubernetes.io/docs/tutorials/ (the tutorial title in this page doesn't match the page title)

Good catch! lets fix that in this PR.

• https://kubernetes.io/docs/tutorials/security/apparmor/ (explain any clean up steps required)

and check whether https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ needs any update for GA.

AFAIK no clean up steps are required. Good call on updating https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

[sftim]

With the new field all annotation based mechanisms are considered deprecated.

Even so, we expect docs (yes, it should have been done for beta, but the thing still needs documenting). We want this partly for formally telling people that there is a new mechanism, and partly because we "register" annotations by documenting them.

[vinayakankugoyal]

With the new field all annotation based mechanisms are considered deprecated.

Even so, we expect docs (yes, it should have been done for beta, but the thing still needs documenting). We want this partly for formally telling people that there is a new mechanism, and partly because we "register" annotations by documenting them.

That annotation is only PSP specific AFAIK. It was a means of specifying what profile should be applied to containers in the event they don't have a profile specified. Support for PSP has long since been deprecated (removed?) and you won't find any reference to that annotation in kubernetes except for PSP docs (which is where it should live?).

[sftim]

That annotation is only PSP specific AFAIK. It was a means of specifying what profile should be applied to containers in the event they don't have a profile specified. Support for PSP has long since been deprecated (removed?) and you won't find any reference to that annotation in kubernetes except for PSP docs (which is where it should live?).

The place to register it is Well-Known Labels, Annotations and Taints, honestly. That's a list of all the registered labels, annotations and taints for the Kubernetes project.

[Princesso]

Hi @vinayakankugoyal since this PR is ready for review, can you remove the draft status? We need to PR in the ready-for-review status before Tuesday, July 16th, 2024 18:00 PST. Thank you!

[SergeyKanzhelev]

Also not sure why this example is still using annotations:

website/content/en/examples/policy/restricted-psp.yaml

Line 8 in 30026fa

apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'

Maybe change it to fields.

[vinayakankugoyal]

Also not sure why this example is still using annotations:

website/content/en/examples/policy/restricted-psp.yaml

Line 8 in 30026fa

apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'

Maybe change it to fields.

PSP has long been deprecated, maybe we should consider removing those docs completely, but we should do so in a separate PR.

[SergeyKanzhelev]

/lgtm

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: 62d919ce978bdd64d57409cae1e7ed557750dc57

[tengqm]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: SergeyKanzhelev, tengqm

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• content/en/docs/OWNERS [tengqm]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[SergeyKanzhelev]

/lgtm

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: 739a68af5218af3bb531be72b9864f27892e1d90