vrr/cozystack
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[cilium] Strip hardcoded AppArmor annotations from vendored daemonset

Browse source 
The upstream chart emits per-container AppArmor unconfined annotations
inside a k8s<1.30 branch of cilium-agent/daemonset.yaml. Cozystack now
owns these annotations via cilium.podAnnotations in values.yaml so they
also take effect on k8s>=1.30 (where upstream drops them in favour of
the containerd-broken podSecurityContext.appArmorProfile). Having both
sources emit the same keys produced a duplicate mapping on k8s<1.30.

Add a new SED_INPLACE invocation to the package Makefile that removes
the four hardcoded annotation lines from the vendored template, and
apply the patch to the currently vendored copy so make update will
reproduce the same state on future refreshes.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
This commit is contained in:
Aleksei Sviridkin 2026-04-11 14:39:37 +03:00
parent 703dbca734
commit 182fc0b52d
No known key found for this signature in database
GPG key ID: 7988329FDF395282
3 changed files with 10 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

10
packages/system/cilium/Makefile
View file

@ -12,6 +12,16 @@ update:
helm repo update cilium
helm pull cilium/cilium --untar --untardir charts --version 1.19
$(SED_INPLACE) -e '/Used in iptables/d' -e '/SYS_MODULE/d' charts/cilium/values.yaml
# Drop the hardcoded AppArmor unconfined annotations from the cilium-agent
# DaemonSet's k8s<1.30 branch. Cozystack manages these through
# cilium.podAnnotations in values.yaml for all k8s versions, and keeping the
# upstream block would produce duplicate mapping keys on k8s<1.30.
$(SED_INPLACE) \
-e '/container\.apparmor\.security\.beta\.kubernetes\.io\/cilium-agent: "unconfined"/d' \
-e '/container\.apparmor\.security\.beta\.kubernetes\.io\/clean-cilium-state: "unconfined"/d' \
-e '/container\.apparmor\.security\.beta\.kubernetes\.io\/mount-cgroup: "unconfined"/d' \
-e '/container\.apparmor\.security\.beta\.kubernetes\.io\/apply-sysctl-overwrites: "unconfined"/d' \
charts/cilium/templates/cilium-agent/daemonset.yaml
version=$$(awk '$$1 == "version:" {print $$2}' charts/cilium/Chart.yaml) && \
$(SED_INPLACE) "s/ARG VERSION=.*/ARG VERSION=v$${version}/" images/cilium/Dockerfile

4
packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml
View file

@ -62,11 +62,7 @@ spec:
# Set app AppArmor's profile to "unconfined". The value of this annotation
# can be modified as long users know which profiles they have available
# in AppArmor.
container.apparmor.security.beta.kubernetes.io/cilium-agent: "unconfined"
container.apparmor.security.beta.kubernetes.io/clean-cilium-state: "unconfined"
{{- if .Values.cgroup.autoMount.enabled }}
container.apparmor.security.beta.kubernetes.io/mount-cgroup: "unconfined"
container.apparmor.security.beta.kubernetes.io/apply-sysctl-overwrites: "unconfined"
{{- end }}
{{- end }}
{{- end }}

5
packages/system/cilium/values.yaml
View file

@ -34,11 +34,6 @@ cilium:
# annotations when the AppArmor LSM is not loaded.
# mount-bpf-fs is intentionally excluded: it runs as privileged, and the
# kernel does not apply AppArmor profiles to privileged containers.
# On unsupported k8s < 1.30 the upstream chart renders the same keys
# inside its own <1.30 branch, yielding a duplicate mapping with
# identical values (last-wins). The supported matrix starts at 1.30
# (packages/apps/kubernetes/files/versions.yaml), so this does not
# affect any shipped version.
podAnnotations:
container.apparmor.security.beta.kubernetes.io/cilium-agent: unconfined
container.apparmor.security.beta.kubernetes.io/clean-cilium-state: unconfined