AppArmor, short for Application Armor, is a Linux kernel security module that provides mandatory access controls for processes, restricting the actions they can perform. In the context of Kubernetes, enabling AppArmor adds an extra layer of security to cluster. AppArmor uses profiles to define what resources and capabilities a specific application or process is allowed to access. AppArmor can enforce stricter security policies on containers, preventing them from accessing unauthorised resources or performing malicious actions.

Remediation

The following example enforces default AppArmor profile on app container.

apiVersion: apps/v1
kind: Deployment
spec:
  template:
    metadata:
      annotations:
        container.apparmor.security.beta.kubernetes.io/myContainer: runtime/default
    spec:
      containers:
      - name: app