diff --git a/pkg/kubelet/kubelet.go b/pkg/kubelet/kubelet.go index dfe0cf42fca..c414b23e1ba 100644 --- a/pkg/kubelet/kubelet.go +++ b/pkg/kubelet/kubelet.go @@ -834,7 +834,7 @@ func NewMainKubelet(kubeCfg *kubeletconfiginternal.KubeletConfiguration, if sysruntime.GOOS == "linux" { // AppArmor is a Linux kernel security module and it does not support other operating systems. - klet.appArmorValidator = apparmor.NewValidator(containerRuntime) + klet.appArmorValidator = apparmor.NewValidator() klet.softAdmitHandlers.AddPodAdmitHandler(lifecycle.NewAppArmorAdmitHandler(klet.appArmorValidator)) } klet.softAdmitHandlers.AddPodAdmitHandler(lifecycle.NewNoNewPrivsAdmitHandler(klet.containerRuntime)) diff --git a/pkg/security/apparmor/validate.go b/pkg/security/apparmor/validate.go index 370af602df4..34a0b1ee368 100644 --- a/pkg/security/apparmor/validate.go +++ b/pkg/security/apparmor/validate.go @@ -29,7 +29,6 @@ import ( utilfeature "k8s.io/apiserver/pkg/util/feature" podutil "k8s.io/kubernetes/pkg/api/v1/pod" "k8s.io/kubernetes/pkg/features" - kubetypes "k8s.io/kubernetes/pkg/kubelet/types" utilpath "k8s.io/utils/path" ) @@ -44,8 +43,8 @@ type Validator interface { } // NewValidator is in order to find AppArmor FS -func NewValidator(runtime string) Validator { - if err := validateHost(runtime); err != nil { +func NewValidator() Validator { + if err := validateHost(); err != nil { return &validator{validateHostErr: err} } appArmorFS, err := getAppArmorFS() @@ -90,7 +89,7 @@ func (v *validator) ValidateHost() error { } // Verify that the host and runtime is capable of enforcing AppArmor profiles. -func validateHost(runtime string) error { +func validateHost() error { // Check feature-gates if !utilfeature.DefaultFeatureGate.Enabled(features.AppArmor) { return errors.New("AppArmor disabled by feature-gate") @@ -106,11 +105,6 @@ func validateHost(runtime string) error { return errors.New("AppArmor is not enabled on the host") } - // Check runtime support. Currently only Docker is supported. - if runtime != kubetypes.DockerContainerRuntime && runtime != kubetypes.RemoteContainerRuntime { - return fmt.Errorf("AppArmor is only enabled for 'docker' and 'remote' runtimes. Found: %q", runtime) - } - return nil } diff --git a/pkg/security/apparmor/validate_test.go b/pkg/security/apparmor/validate_test.go index 65ab4e4f4f6..03b4a487f47 100644 --- a/pkg/security/apparmor/validate_test.go +++ b/pkg/security/apparmor/validate_test.go @@ -43,8 +43,7 @@ func TestValidateHost(t *testing.T) { // The test should be manually run if modifying the getAppArmorFS function. t.Skip() - assert.NoError(t, validateHost("docker")) - assert.Error(t, validateHost("rkt")) + assert.NoError(t, validateHost()) } func TestValidateProfileFormat(t *testing.T) {