vrr/cozystack
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[cilium] Clarify nsenter/AppArmor comment wording

Browse source 
Replace the misleading 'nsenter --ptrace' shorthand with an accurate
description: nsenter joins the host cgroup/mount namespace, and the
cri-containerd.apparmor.d profile reports the denial as a blocked
'ptrace' operation (operation name, not an nsenter CLI flag).

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
(cherry picked from commit 0b0d3de99d)
This commit is contained in:
Aleksei Sviridkin 2026-04-11 15:13:03 +03:00 • committed by github-actions[bot]
parent 016fe585b5
commit caacf92507
1 changed files with 4 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
packages/system/cilium/values.yaml
View file

@ -24,9 +24,10 @@ cilium:
rollOutPods: true
replicas: 1
# Opt out of the cri-containerd.apparmor.d profile for containers that invoke
# nsenter --ptrace to join the host cgroup/mount namespace. Required on
# Ubuntu 22.04+ and other distros that load this AppArmor profile by default,
# where the denial puts cilium-agent into Init:CrashLoopBackOff.
# nsenter to join the host cgroup/mount namespace. The kernel reports the
# denial as a blocked "ptrace" operation. Required on Ubuntu 22.04+ and
# other distros that load this AppArmor profile by default, where the
# denial otherwise puts cilium-agent into Init:CrashLoopBackOff.
# The deprecated annotations are used because k8s >= 1.30 pod-level
# appArmorProfile: Unconfined is not honoured by containerd CRI today
# (kubernetes/kubernetes#125069).