From 567c32ef783448ab011fdfe10b5b929f131eac8d Mon Sep 17 00:00:00 2001
From: Steve Perry <steveperry-53@users.noreply.github.com>
Date: Tue, 14 Mar 2017 19:09:08 -0700
Subject: [PATCH] Apparmor (#2825)

* Move Guide topic: AppArmor.

* Add included files.
---
 docs/tutorials/clusters/apparmor.md             |  5 +++--
 docs/tutorials/clusters/deny-write.profile      | 10 ++++++++++
 docs/tutorials/clusters/hello-apparmor-pod.yaml | 13 +++++++++++++
 3 files changed, 26 insertions(+), 2 deletions(-)
 create mode 100644 docs/tutorials/clusters/deny-write.profile
 create mode 100644 docs/tutorials/clusters/hello-apparmor-pod.yaml

diff --git a/docs/tutorials/clusters/apparmor.md b/docs/tutorials/clusters/apparmor.md
index 224f0bbdeb..881c2e72a6 100644
--- a/docs/tutorials/clusters/apparmor.md
+++ b/docs/tutorials/clusters/apparmor.md
@@ -140,7 +140,8 @@ In this example you'll see:
 First, we need to load the profile we want to use onto our nodes. The profile we'll use simply
 denies all file writes:
 
-{% include code.html language="text" file="deny-write.profile" ghlink="/docs/admin/apparmor/deny-write.profile" %}
+
+{% include code.html language="text" file="deny-write.profile" ghlink="/docs/tutorials/clusters/deny-write.profile" %}
 
 Since we don't know where the Pod will be scheduled, we'll need to load the profile on all our
 nodes. For this example we'll just use SSH to install the profiles, but other approaches are
@@ -167,7 +168,7 @@ discussed in [Setting up nodes with profiles](#setting-up-nodes-with-profiles).
 
 Next, we'll run a simple "Hello AppArmor" pod with the deny-write profile:
 
-{% include code.html language="yaml" file="hello-apparmor-pod.yaml" ghlink="/docs/admin/apparmor/hello-apparmor-pod.yaml" %}
+{% include code.html language="yaml" file="hello-apparmor-pod.yaml" ghlink="/docs/tutorials/clusters/hello-apparmor-pod.yaml" %}
 
     $ kubectl create -f /dev/stdin <<EOF
     apiVersion: v1
diff --git a/docs/tutorials/clusters/deny-write.profile b/docs/tutorials/clusters/deny-write.profile
new file mode 100644
index 0000000000..c2653c7112
--- /dev/null
+++ b/docs/tutorials/clusters/deny-write.profile
@@ -0,0 +1,10 @@
+#include <tunables/global>
+
+profile k8s-apparmor-example-deny-write flags=(attach_disconnected) {
+  #include <abstractions/base>
+
+  file,
+
+  # Deny all file writes.
+  deny /** w,
+}
diff --git a/docs/tutorials/clusters/hello-apparmor-pod.yaml b/docs/tutorials/clusters/hello-apparmor-pod.yaml
new file mode 100644
index 0000000000..3e9b3b2a9c
--- /dev/null
+++ b/docs/tutorials/clusters/hello-apparmor-pod.yaml
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: hello-apparmor
+  annotations:
+    # Tell Kubernetes to apply the AppArmor profile "k8s-apparmor-example-deny-write".
+    # Note that this is ignored if the Kubernetes node is not running version 1.4 or greater.
+    container.apparmor.security.beta.kubernetes.io/hello: localhost/k8s-apparmor-example-deny-write
+spec:
+  containers:
+  - name: hello
+    image: busybox
+    command: [ "sh", "-c", "echo 'Hello AppArmor!' && sleep 1h" ]