Set AppArmor profile via SecurityContext rather than annotations (k8s >=1.30)
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	JMeybohm
	Jun 18 2024, 2:01 PM

Description

With Kubernetes 1.30+, AppArmor profiles can now be configured through fields on the PodSecurityContext and container SecurityContext. The beta AppArmor annotations are deprecated, and AppArmor status is no longer included in the node ready condition. (https://github.com/kubernetes/kubernetes/pull/123435)

Details

Related Changes in Gerrit:

Subject	Repo	Branch	Lines +/-
function-{evaluator,orchestrator}: set AppArmor profile in container SecurityContext	operations/deployment-charts	master	+10 -4
Revert "function-{evaluator,orchestrator}: set AppArmor profile in pod SecurityContext"	operations/deployment-charts	master	+4 -13
function-{evaluator,orchestrator}: set AppArmor profile in pod SecurityContext	operations/deployment-charts	master	+13 -4

Customize query in gerrit

Related Objects
Search...

		Status	Subtype	Assigned	Task
		Resolved		JMeybohm	T341984 Update Kubernetes clusters to 1.31
		Resolved		RLazarus	T367880 Set AppArmor profile via SecurityContext rather than annotations (k8s >=1.30)

Event Timeline

JMeybohm created this task.Jun 18 2024, 2:01 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJun 18 2024, 2:01 PM

JMeybohm triaged this task as Low priority.Jun 18 2024, 2:01 PM

JMeybohm merged a task: T384429: Migrate deprecated apparmor.security.beta.kubernetes.io annotations to SecurityContext.Mar 5 2025, 6:10 PM

JMeybohm added a subscriber: akosiaris.

RLazarus edited projects, added ServiceOps new; removed serviceops-deprecated.Feb 12 2026, 2:03 AM

RLazarus moved this task from Inbox to Backlog on the ServiceOps new board.

RLazarus merged a task: T419784: Change Wikifunctions k8s pods apparmor annotation to a config field, former is deprecated since k8s 1.30.Mar 12 2026, 2:33 AM

RLazarus added a subscriber: Jdforrester-WMF.

Change #1254338 had a related patch set uploaded (by RLazarus; author: RLazarus):

[operations/deployment-charts@master] function-{evaluator,orchestrator}: set AppArmor profile in pod SecurityContext

https://gerrit.wikimedia.org/r/1254338

gerritbot added a project: Patch-For-Review.Mar 17 2026, 9:27 PM

@RLazarus: Given wikifunctions is the only chart with apparmor annotations I'll hand this over to you to close when the change has been merged.

Change #1254338 merged by jenkins-bot:

[operations/deployment-charts@master] function-{evaluator,orchestrator}: set AppArmor profile in pod SecurityContext

https://gerrit.wikimedia.org/r/1254338

Weirdly, Envoy failed to start after the change, with this in the logs:

[2026-04-08 21:23:16.649][1][critical][assert] [source/server/hot_restart_impl.cc:44] panic: cannot open shared memory region /envoy_shared_memory_0 check user permissions. Error: Permission denied

That wouldn't be that surprising if we were setting up a new AppArmor profile, but nothing is supposed to be changing with the actual policy.

Change #1269064 had a related patch set uploaded (by RLazarus; author: RLazarus):

[operations/deployment-charts@master] Revert "function-{evaluator,orchestrator}: set AppArmor profile in pod SecurityContext"

https://gerrit.wikimedia.org/r/1269064

Change #1269064 merged by jenkins-bot:

[operations/deployment-charts@master] Revert "function-{evaluator,orchestrator}: set AppArmor profile in pod SecurityContext"

https://gerrit.wikimedia.org/r/1269064

Change #1269069 had a related patch set uploaded (by RLazarus; author: RLazarus):

[operations/deployment-charts@master] function-{evaluator,orchestrator}: set AppArmor profile in container SecurityContext

https://gerrit.wikimedia.org/r/1269069

Change #1269069 merged by jenkins-bot: