Fix AppArmor profile Apply() function to correctly handle an "Unconfined" mode

[roman-kiselenko]

What type of PR is this?

/kind bug

What this PR does / why we need it:

When applying a given AppArmor profile, the Apply() function should correctly handle the "Unconfined" profile type for both fields, the Apparmor (which is a SecurityProfile type) and ApparmorProfile (a bare string), of the LinuxContainerSecurityContext type.

Related:

• Cilium pod got Init:CreateContainerError on Ubuntu 24.04, k8s 1.30 cilium/cilium#32198

Which issue(s) this PR fixes:

Fixes #8080.

Special notes for your reviewer:

None

Does this PR introduce a user-facing change?

None

Fix AppArmour profile Apply() function to correctly handle an "Unconfined" mode.

[roman-kiselenko]

/cc @saschagrunert @kwilczynski @haircommander

[kwilczynski]

/cc @saschagrunert @kwilczynski @haircommander

@roman-kiselenko, feel free to use @cri-o/cri-o-maintainers handle here. It casts a wider net of maintainers.

[kwilczynski]

@roman-kiselenko, I've made some changes to the subject and description (feel free to edit this one as needed).

The commit subjects should be as imperative as possible, within reason. That said, I cannot adjust the commit subject line itself, so this is something you could do, if you want and have a moment.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 49.70%. Comparing base (8b966a8) to head (d914961).
Report is 6 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8103      +/-   ##
==========================================
+ Coverage   49.67%   49.70%   +0.02%     
==========================================
  Files         153      153              
  Lines       16826    16827       +1     
==========================================
+ Hits         8359     8364       +5     
+ Misses       7423     7420       -3     
+ Partials     1044     1043       -1     

[kwilczynski]

/hold

Waiting for the commit message to be updated.

[kwilczynski]

/unhold

[kwilczynski]

/retest

[roman-kiselenko]

/hold

I'm going to rebase after merge

#7881

[roman-kiselenko]

/unhold

There is merged v1.30 version #8094

[haircommander]

/approve
/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: haircommander, roman-kiselenko

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [haircommander]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[haircommander]

/retest

[jadedeane]

Despite seemingly correct annotations, still seeing 'unconfined' return:

empty localhost AppArmor profile is forbidden

[kwilczynski]

@jadedeane, please reply to and even possibly re-open the following:

• Unable to run pods with apparmor type "Unconfined" #8080

[jadedeane]

@kwilczynski apologies, sorted moving up to 1.31.0~dev-2.1.

[kwilczynski]

@jadedeane, no worries.

So, just to confirm: you are all good here? Everything works as expected?

[jadedeane]

@jadedeane, no worries.

So, just to confirm: you are all good here? Everything works as expected?

Yes, thanks!