whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update AppArmor requirement section (#17531)

Browse Source 
Mainly all runtimes support AppArmor from now on, so we should update
the documentation accordingly.

Signed-off-by: Sascha Grunert <sgrunert@suse.com>
This commit is contained in:
Sascha Grunert
2019-11-12 03:30:07 +01:00
committed by Kubernetes Prow Robot
parent a3f671a816
commit 7f9f9d9fbe
1 changed files with 5 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/tutorials/clusters/apparmor.md
+5 -15
View File
@@ -73,21 +73,11 @@ Make sure:
tested with the upstream version, and does not promise support for other features. tested with the upstream version, and does not promise support for other features.
{{< /note >}} {{< /note >}}
3. Container runtime is Docker -- Currently the only Kubernetes-supported container runtime that 3. Container runtime supports AppArmor -- Currently all common Kubernetes-supported container
also supports AppArmor is Docker. As more runtimes add AppArmor support, the options will be runtimes should support AppArmor, like {{< glossary_tooltip term_id="docker">}},
expanded. You can verify that your nodes are running docker with: {{< glossary_tooltip term_id="cri-o" >}} or {{< glossary_tooltip term_id="containerd" >}}.
Please refer to the corresponding runtime documentation and verify that the cluster fulfills
```shell the requirements to use AppArmor.
kubectl get nodes -o=jsonpath=$'{range .items[*]}{@.metadata.name}: {@.status.nodeInfo.containerRuntimeVersion}\n{end}'
```
```
gke-test-default-pool-239f5d02-gyn2: docker://1.11.2
gke-test-default-pool-239f5d02-x1kf: docker://1.11.2
gke-test-default-pool-239f5d02-xwux: docker://1.11.2
```
If the Kubelet contains AppArmor support (>= v1.4), it will refuse to run a Pod with AppArmor
options if the runtime is not Docker.
4. Profile is loaded -- AppArmor is applied to a Pod by specifying an AppArmor profile that each 4. Profile is loaded -- AppArmor is applied to a Pod by specifying an AppArmor profile that each
container should be run with. If any of the specified profiles is not already loaded in the container should be run with. If any of the specified profiles is not already loaded in the