Modify apparmor.md and delete .profile to enable the site to build with Hugo 0.57.2. Could not cherry pick PR 16531 because the Korean translation was added in 1.14. See also PRs #16104 and #16151. zh/docs/reference/setup-tools/kubeadm/generated/README.md updated to fix 'invalid YAML delimiter' compile error caused by HTML comment. Signed-off-by: Aimee Ukasick <aimeeu.opensource@gmail.com>
This commit is contained in:
committed by
Kubernetes Prow Robot
parent
1a02f19649
commit
f8162b0ef6
@@ -166,7 +166,18 @@ k8s-apparmor-example-deny-write (enforce)
|
||||
First, we need to load the profile we want to use onto our nodes. The profile we'll use simply
|
||||
denies all file writes:
|
||||
|
||||
{{< code language="text" file="deny-write.profile" >}}
|
||||
```shell
|
||||
#include <tunables/global>
|
||||
|
||||
profile k8s-apparmor-example-deny-write flags=(attach_disconnected) {
|
||||
#include <abstractions/base>
|
||||
|
||||
file,
|
||||
|
||||
# Deny all file writes.
|
||||
deny /** w,
|
||||
}
|
||||
```
|
||||
|
||||
Since we don't know where the Pod will be scheduled, we'll need to load the profile on all our
|
||||
nodes. For this example we'll just use SSH to install the profiles, but other approaches are
|
||||
|
||||
@@ -1,10 +0,0 @@
|
||||
#include <tunables/global>
|
||||
|
||||
profile k8s-apparmor-example-deny-write flags=(attach_disconnected) {
|
||||
#include <abstractions/base>
|
||||
|
||||
file,
|
||||
|
||||
# Deny all file writes.
|
||||
deny /** w,
|
||||
}
|
||||
Reference in New Issue
Block a user