Add appArmorProfile to securityContext

[jbmolle]

Description: Add appArmorProfile in securityContext definitions so it is not removed by openteletry-operator

Link to tracking Issue(s): #3036

• Resolves: appArmorProfile is removed from SecurityContext #3036

Testing: None

Documentation: None

[linux-foundation-easycla]

• ❌ - login: @jbmolle / name: jbmolle . The commit (b3c066e) is not authorized under a signed CLA. Please click here to be authorized. For further assistance with EasyCLA, please submit a support request ticket.

[swiatekm]

We use the SecurityContext definition from the Kubernetes API. From what I can see, appArmorProfile was added in Kubernetes 1.30, and we haven't yet upgraded to its API libraries. The reason is that they require Go 1.22, and we still support 1.21 as per #2757.

[jbmolle]

@swiatekm-sumo Thanks for the feedback, that's very helpful!
I've actually found the problem when I tried to update Cilium to version 1.15.5 which uses appArmorProfile instead of annotations.
The init containers from Cilium can't start because opentelemetry-operator modifies the pod yaml sent to kube-apiserver.
Is there a way to exclude the pod YAML from being mutated by the webhook? (With an annotation maybe?)

[swiatekm]

I don't think there's a way to do that, unfortunately. It's not so much that the operator modifies the Pod, but rather deserializes the Pod data into a struct that doesn't have the appArmor field, so the field is effectively ignored and the operator isn't even aware it exists. Best you can do if you want to solve this in the short term, would be to fork the operator, update the API libraries, and build with Go 1.22.

[swiatekm]

@jbmolle can we close this PR? #3036 was fixed by #3061.

[jbmolle]

Yes sure