how to fix the security recommendation "Overriding or disabling of containers AppArmor profile should be restricted"

Question

Hello Team,

I am getting Azure Policy security recommendation "Overriding or disabling of containers AppArmor profile should be restricted". I have applied below annotation as suggested here,

annotations:
container.apparmor.security.beta.kubernetes.io/azure-vote-back: runtime/default

https://learn.microsoft.com/en-us/azure/security-center/kubernetes-workload-protections#healthy-deployment-example-yaml-file

But still the security recommendation persists. Is there anything else I need to do?

apiVersion: apps/v1
kind: Deployment
metadata:
name: azure-vote-back
namespace: my-dev
spec:
replicas: 1
selector:
matchLabels:
app: azure-vote-back
template:
metadata:
labels:
app: azure-vote-back
annotations:
container.apparmor.security.beta.kubernetes.io/azure-vote-back: runtime/default
spec:
containers:
- name: azure-vote-back
image: redis
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
cpu: 100m
memory: 128Mi
ports:
- containerPort: 6379
name: redis
securityContext:
privileged: false
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
runAsNonRoot: true
runAsUser: 1000

Answer 1

@@IamCoder , thank you for your question. We regret the delayed response and any inconvenience it may have caused.

Some recommendations have parameters that must be customized via Azure Policy to use them effectively. For example, to benefit from the recommendation Container images should be deployed only from trusted registries, you'll have to define your trusted registries.

If you don't enter the necessary parameters for the recommendations that require configuration, your workloads will be shown as unhealthy.

[Reference]

By default the Policy definition for Kubernetes cluster containers should only use allowed AppArmor profiles has an empty list specified for allowedProfiles:

...  
"allowedProfiles": {  
        "type": "Array",  
        "metadata": {  
          "displayName": "Allowed AppArmor profiles",  
          "description": "The list of AppArmor profiles that containers are allowed to use. E.g. 'runtime/default;docker/default'. Provide empty list as input to block everything."  
        },  
        "defaultValue": []  
      },  
...  

So, if you are using the profile runtime/default you have to modify the security policy to add the same in the allowedProfiles array.

----------

Hope this helps.

Please "Accept as Answer" if it helped, so that it can help others in the community looking for help on similar topics.