Podman AppArmor profile for kubernetes

[franrebo84]

After following this great article https://www.redhat.com/sysadmin/podman-inside-kubernetes. I'm facing the following issue for the non-privileged scenario:

Error: mount /var/lib/containers/storage/overlay:/var/lib/containers/storage/overlay, flags: 0x1000: permission denied
This is because appArmor is denying the mount syscall for fuse-overlay in the Kubernetes node OS.

I was able to fix itsetting the AppArmor profile to unconfined with a Kubernetes annotation:

container.apparmor.security.beta.kubernetes.io/no-priv: unconfined

But this is more a workaround than a proper solution to the issue.

I couldn't find any documentation for this and most of the similar issues said to just use the annotation.
Does anyone was able to create a working AppArmor profile for this?

[rhatdan]

We mainly work with SELinux in the core team, so not likely to get help from us.