apparmor: Install a default apparmor profile

[randomvariable]

Part of #231

Should install a profile you can use in Kubernetes, as well as ensuring the right binaries exist on PhotonOS.

Been unable to get Packer to run on vSphere though.

Signed-off-by: Naadir Jeewa jeewan@vmware.com

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: randomvariable
To complete the pull request process, please assign davidewatson
You can assign the PR to them by writing /assign @davidewatson in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• images/capi/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[randomvariable]

/hold

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[k8s-ci-robot]

@randomvariable: PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[EleanorRigby]

@randomvariable: What more needs to be done here? Do we need this support across OSs or just photon OS?

Been unable to get Packer to run on vSphere though.

Is this appArmor problem or waiting for ip timeout issue?

[randomvariable]

I didn't actually test it, I think at the time I wrote this, I didn't know how to get image builder to work. Thanks for reminding me.

[randomvariable]

/remove lifecycle

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[detiber]

/remove-lifecycle rotten

[detiber]

Would it make sense to try and detect this?

I think there are potentially a few different approaches we could take here:

• simply check if /etc/apparmor.d/ exists
• check /sys/kernel/security/lsm to see if apparmor is present
• check if /sys/module/apparmor/parameters/enabled exists

[detiber]

This conditional also seems redundant with the same conditional existing on the import_tasks in iamges/capi/ansible/roles/containerd/tasks/main.yml

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle rotten

[k8s-ci-robot]

@randomvariable: The following tests failed, say /retest to rerun all failed tests:

Test name	Commit	Details	Rerun command
pull-azure-all	7b9ede9	link	/test pull-azure-all
pull-azure-vhds	7b9ede9	link	/test pull-azure-vhds
json-sort-check	7b9ede9	link	/test json-sort-check
pull-packer-validate	7b9ede9	link	/test pull-packer-validate
pull-goss-populate	7b9ede9	link	/test pull-goss-populate

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-contributor-experience at kubernetes/community.
/close

[k8s-ci-robot]

@fejta-bot: Closed this PR.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-contributor-experience at kubernetes/community.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.