Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Apparmor configuration and related docs #1818

Open
mythi opened this issue Aug 28, 2024 · 0 comments · May be fixed by #1860
Open

Update Apparmor configuration and related docs #1818

mythi opened this issue Aug 28, 2024 · 0 comments · May be fixed by #1860
Labels
qat QAT device plugin related issue

Comments

@mythi
Copy link
Contributor

mythi commented Aug 28, 2024

Describe the bug
QAT plugin Apparmor settings are outdated

To Reproduce
See intel-qat-plugin.yaml.

Expected behavior
Apparmor is GA starting k8s v1.30. The settings and documentation must be updated.

Screenshots
N/A

System (please complete the following information):

  • Kubernetes v1.30+

Additional context
Ubuntu and SUSE based distros have Apparmor enabled and that blocks certain QAT plugin functions. In particular, when the plugin tries to write QAT VF IDs to vfio-pci driver. Other plugins are not impacted.

Adding

securityContext:
  appArmorProfile:
    type: unconfined

to intel-qat-plugin.yaml is easy but then we loose configurability which we had with the annotation but is that needed? It is possible to configure nodes so that unconfined is not needed so likely some configurability is useful.

@mythi mythi added the qat QAT device plugin related issue label Aug 28, 2024
@github-staff github-staff deleted a comment Aug 28, 2024
@mythi mythi linked a pull request Sep 30, 2024 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
qat QAT device plugin related issue
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant