AppArmor documentation

_data/guides.yml

@@ -286,3 +286,5 @@ toc:
     path: /docs/admin/salt/
   - title: Monitoring Node Health
     path: /docs/admin/node-problem/
+  - title: AppArmor
+    path: /docs/admin/apparmor/

docs/admin/apparmor/deny-write.profile

@@ -0,0 +1,10 @@
+#include <tunables/global>
+
+profile k8s-apparmor-example-deny-write flags=(attach_disconnected) {
+  #include <abstractions/base>
+
+  file,
+
+  # Deny all file writes.
+  deny /** w,
+}

docs/admin/apparmor/hello-apparmor-pod.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: hello-apparmor
+  annotations:
+    # Tell Kubernetes to apply the AppArmor profile "k8s-apparmor-example-deny-write".
+    # Note that this is ignored if the Kubernetes node is not running version 1.4 or greater.
+    container.apparmor.security.beta.kubernetes.io/hello: localhost/k8s-apparmor-example-deny-write
+spec:
+  containers:
+  - name: hello
+    image: busybox
+    command: [ "sh", "-c", "echo 'Hello AppArmor!' && sleep 1h" ]