apparmor

Documentation

Index

• Constants
• type AppArmor
  • func New() *AppArmor
  • func (a *AppArmor) Audit(resource k8s.Resource, _ []k8s.Resource) ([]*kubeaudit.AuditResult, error)

Constants

const (
	// AppArmorAnnotationMissing occurs when the apparmor annotation is missing
	AppArmorAnnotationMissing = "AppArmorAnnotationMissing"
	// AppArmorDisabled occurs when the apparmor annotation is set to the unconfined value
	AppArmorDisabled = "AppArmorDisabled"
	// AppArmorDisabled occurs when the apparmor annotation is set to a bad value
	AppArmorBadValue = "AppArmorBadValue"
	// AppArmorInvalidAnnotation occurs when the apparmor annotation key refers to a container which doesn't exist. This will
	// prevent the manifest from being applied to a cluster with AppArmor enabled.
	AppArmorInvalidAnnotation = "AppArmorInvalidAnnotation"
)

const (
	// The prefix to an annotation key specifying a container profile.
	ContainerAnnotationKeyPrefix = "container.apparmor.security.beta.kubernetes.io/"

	// The profile specifying the runtime default.
	ProfileRuntimeDefault = "runtime/default"
	// The profile specifying the unconfined profile.
	ProfileUnconfined = "unconfined"
	// The prefix for specifying profiles loaded on the node.
	ProfileNamePrefix = "localhost/"
)

As of Jan 14, 2020 these constants are not in the K8s API package, but once they are they should be replaced https://github.com/kubernetes/kubernetes/blob/master/pkg/security/apparmor/helpers.go#L25

const Name = "apparmor"

const OverrideLabel = "allow-disabled-apparmor"

Types

type AppArmor

type AppArmor struct{}

AppArmor implements Auditable

func New

func New() *AppArmor

func (*AppArmor) Audit

func (a *AppArmor) Audit(resource k8s.Resource, _ []k8s.Resource) ([]*kubeaudit.AuditResult, error)

Audit checks that AppArmor is enabled for all containers