CKS认证-AppArmor

14. AppArmor

**注意：**这道题给大家更新一下，在做这题的时候一定要检查kubelet的版本是1.28还是1.30.如果是1.30的话，按照官网最新文档去修改annotaions的值。如果是1.28的版本，一定要在kubernetes.io官网上把版本切换成1.28的版本再去做这道题。建议大家两种方法都要掌握一下！！！

  1 apiVersion: v1
  2 kind: Pod
  3 metadata:
  4   name: nginx-deploy
  5   annotations:
  6     container.apparmor.security.beta.kubernetes.io/nginx-deploy: localhost/nginx-profile-1
  7 spec:
  8   containers:
  9   - name: nginx-deploy
 10     image: busybox
 11     command: [ "sh", "-c", "echo 'Hello AppArmor!' && sleep 1h" ]

问题：

Context
AppArmor 已在 cluster 的工作节点上被启用。一个 AppArmor 配置文件已存在，但尚未被实施。
:::info
您可以使用浏览器打开一个额外的标签页来访问 AppArmor 的文档。
:::
Task
在 cluster 的工作节点上，实施位于/etc/apparmor.d/nginx_apparmor 的现有AppArmor 配置文件。
编辑位于/home/candidate/KSSH00401/nginx-deploy.yaml的现有清单文件以应用 AppArmor 配置文件。
最后，应用清单文件并创建其中指定的 Pod。

正确答案：

注意：
ssh 到 node 节点加载apparmor配置⽂件 , 集群中所有node节点都要配置!
ssh 到 node 节点加载apparmor配置⽂件 , 集群中所有node节点都要配置!
ssh 到 node 节点加载apparmor配置⽂件 , 集群中所有node节点都要配置!
配置 Pod 使⽤该策略： (退回主节点)
回主节点运⾏kubectl,考试时不要忘记切换 context
回主节点运⾏kubectl,考试时不要忘记切换 context
回主节点运⾏kubectl,考试时不要忘记切换 context

:::info
提示：
如果忘记加载的命令可以输入appa 摁tab键，查询相关命令
:::

root@hk8s-master01:/etc/apparmor.d# vim nginx_apparmor
#include <tunables/global>
profile nginx-profile-1 flags=(attach_disconnected) {
  #include <abstractions/base>
  file,
  # Deny all file writes.
  deny /** w,
}

加载文件，需要ssh到所有node节点上加载，不能在master上加载。加载完成后，在exit 退回到master节点，执行后面操作

##查看apparmor的状态
root@hk8s-master01:/home/candidate/KSSH00401# apparmor_status 
apparmor module is loaded.
34 profiles are loaded.
34 profiles are in enforce mode.
   /snap/snapd/20290/usr/lib/snapd/snap-confine
   /snap/snapd/20290/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /snap/snapd/20671/usr/lib/snapd/snap-confine
   /snap/snapd/20671/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /snap/snapd/21184/usr/lib/snapd/snap-confine
   /snap/snapd/21184/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/bin/man
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/NetworkManager/nm-dhcp-helper
   /usr/lib/connman/scripts/dhclient-script
   /usr/lib/snapd/snap-confine
   /usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/sbin/chronyd
   /usr/sbin/tcpdump
   /{,usr/}sbin/dhclient
   cri-containerd.apparmor.d
   lsb_release
   man_filter
   man_groff
   nvidia_modprobe
   nvidia_modprobe//kmod
   snap-update-ns.lxd
   snap.lxd.activate
   snap.lxd.benchmark
   snap.lxd.buginfo
   snap.lxd.check-kernel
   snap.lxd.daemon
   snap.lxd.hook.configure
   snap.lxd.hook.install
   snap.lxd.hook.remove
   snap.lxd.lxc
   snap.lxd.lxc-to-lxd
   snap.lxd.lxd
   snap.lxd.migrate
0 profiles are in complain mode.
6 processes have profiles defined.
6 processes are in enforce mode.
   /usr/sbin/chronyd (922) 
   /usr/sbin/chronyd (926) 
   /usr/local/bin/etcd (1478) cri-containerd.apparmor.d
   /usr/local/bin/kube-apiserver (51922) cri-containerd.apparmor.d
   /usr/local/bin/kube-controller-manager (1071408) cri-containerd.apparmor.d
   /usr/local/bin/kube-scheduler (1071481) cri-containerd.apparmor.d
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.

##加载文件
root@hk8s-master01:/home/candidate/KSSH00401# apparmor_parser -q /etc/apparmor.d/nginx_apparmor 

##加载完成后你会在输出的结果里面看到nginx_apparmor配置文件，不加载是没有这个文件的
root@hk8s-master01:/home/candidate/KSSH00401# apparmor_status 
apparmor module is loaded.
35 profiles are loaded.
35 profiles are in enforce mode.
   /snap/snapd/20290/usr/lib/snapd/snap-confine
   /snap/snapd/20290/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /snap/snapd/20671/usr/lib/snapd/snap-confine
   /snap/snapd/20671/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /snap/snapd/21184/usr/lib/snapd/snap-confine
   /snap/snapd/21184/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/bin/man
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/NetworkManager/nm-dhcp-helper
   /usr/lib/connman/scripts/dhclient-script
   /usr/lib/snapd/snap-confine
   /usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/sbin/chronyd
   /usr/sbin/tcpdump
   /{,usr/}sbin/dhclient
   cri-containerd.apparmor.d
   lsb_release
   man_filter
   man_groff
   nginx-profile
   nvidia_modprobe
   nvidia_modprobe//kmod
   snap-update-ns.lxd
   snap.lxd.activate
   snap.lxd.benchmark
   snap.lxd.buginfo
   snap.lxd.check-kernel
   snap.lxd.daemon
   snap.lxd.hook.configure
   snap.lxd.hook.install
   snap.lxd.hook.remove
   snap.lxd.lxc
   snap.lxd.lxc-to-lxd
   snap.lxd.lxd
   snap.lxd.migrate
0 profiles are in complain mode.
6 processes have profiles defined.
6 processes are in enforce mode.
   /usr/sbin/chronyd (922) 
   /usr/sbin/chronyd (926) 
   /usr/local/bin/etcd (1478) cri-containerd.apparmor.d
   /usr/local/bin/kube-apiserver (51922) cri-containerd.apparmor.d
   /usr/local/bin/kube-controller-manager (1071408) cri-containerd.apparmor.d
   /usr/local/bin/kube-scheduler (1071481) cri-containerd.apparmor.d
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.

配置yaml文件

root@hk8s-master01:/home/candidate/KSSH00401# vim nginx-deploy.yaml 
  1 apiVersion: v1
  2 kind: Pod
  3 metadata:
  4   name: nginx-deploy
  5   annotations:
  6     container.apparmor.security.beta.kubernetes.io/nginx-deploy: localhost/nginx-profile-1
  7 spec:
  8   containers:
  9   - name: nginx-deploy
 10     image: busybox
 11     command: [ "sh", "-c", "echo 'Hello AppArmor!' && sleep 1h" ]

检查正确的输出结果

root@hk8s-master01:/home/candidate/KSSH00401# kubectl exec nginx-deploy -- cat /proc/1/attr/current
nginx-profile-1 (enforce)