Ubuntu use fuse with generic-device-plugin Permission denied

[ppancake]

Hi, We're using the generic-device-plugin for /dev/fuse in Kubernetes with the following pod configuration:

      securityContext:
        capabilities:
          add:
            - SYS_ADMIN
      resources:
        limits:
          miks.io/fuse: 1

This setup works properly on CentOS nodes, but we're encountering permission denied errors on Ubuntu nodes. I suspect this might be related to AppArmor security policies. How can we resolve this while maintaining security best practices?

[mueckinger]

I suspect this might be related to AppArmor security policies.

Your assumption is correct. This works on Ubuntu based nodes:

      securityContext:
        appArmorProfile:
          type: Unconfined
        capabilities:
          add:
            - SYS_ADMIN