Apparmor azure policy configuration for linkerd-proxy/linkerd-init containers

[anoopjoseph02]

Hi,

I want to configure Azure Apparmor policy for application pods which runs application as well as linkerd proxy containers.We need to add annotations to container as below. I did the same for application container but not sure how that can be done for linker proxy/init containers..Does linkerd supports custom annotations to be passed during injection?

I saw annotations in below link are the ones supported. Please clarify.

https://linkerd.io/2.10/reference/proxy-configuration/

+++++++++++++++++
AppArmor profiles are specified per-container. To specify the AppArmor profile to run a Pod container with, add an annotation to the Pod's metadata:

container.apparmor.security.beta.kubernetes.io/<container_name>: <profile_ref>
++++++++++++++++++

[olix0r]

I think you'd have to set these annotations yourself for now or use a general-purpose Mutating Admission Controller to apply these annotations to your workloads.

One alternative would be to use the Linkerd CNI so that you don't need the proxy-init container.

[anoopjoseph02]

Hi,

I added the annotation to application workloads and it is working as expected.How can I apply the same annotation to linkerd-proxy/init containers?

When I set below annotation for proxy/init container in Application pod spec it gave error that proxy/init container not found.

++++++++++

container.apparmor.security.beta.kubernetes.io/linkerd-proxy: runtime/default

container.apparmor.security.beta.kubernetes.io/linkerd-init: runtime/default

++++++++++
so where should I set these annotation for linkerd-proxy/init containers?

[kleimkuhler]

You should be able to set the podAnnotations value in values.yaml.

Going off your original question, if the container name is needed in the annotation value, then setting podAnnotations to the below should work:

config.yaml

podAnnotations:
  container.apparmor.security.beta.kubernetes.io/linkerd-proxy: <profile_ref>
  container.apparmor.security.beta.kubernetes.io/linkerd-init: <profile_ref>

And then install:

$ linkerd install --values config.yaml