diff --git a/test/integration/manifests/cilium/daemonset.yaml b/test/integration/manifests/cilium/daemonset.yaml index a710c23360..745ae830fb 100644 --- a/test/integration/manifests/cilium/daemonset.yaml +++ b/test/integration/manifests/cilium/daemonset.yaml @@ -16,10 +16,6 @@ spec: template: metadata: annotations: - container.apparmor.security.beta.kubernetes.io/apply-sysctl-overwrites: unconfined - container.apparmor.security.beta.kubernetes.io/cilium-agent: unconfined - container.apparmor.security.beta.kubernetes.io/clean-cilium-state: unconfined - container.apparmor.security.beta.kubernetes.io/mount-cgroup: unconfined prometheus.io/port: "9962" prometheus.io/scrape: "true" creationTimestamp: null @@ -102,6 +98,8 @@ spec: timeoutSeconds: 5 resources: {} securityContext: + appArmorProfile: + type: Unconfined capabilities: add: - CHOWN @@ -197,6 +195,8 @@ spec: name: mount-cgroup resources: {} securityContext: + appArmorProfile: + type: Unconfined capabilities: add: - SYS_ADMIN @@ -229,6 +229,8 @@ spec: name: apply-sysctl-overwrites resources: {} securityContext: + appArmorProfile: + type: Unconfined capabilities: add: - SYS_ADMIN @@ -287,6 +289,8 @@ spec: cpu: 100m memory: 100Mi securityContext: + appArmorProfile: + type: Unconfined capabilities: add: - NET_ADMIN diff --git a/test/integration/manifests/cilium/v1.16/cilium-agent/templates/daemonset-dualstack.yaml b/test/integration/manifests/cilium/v1.16/cilium-agent/templates/daemonset-dualstack.yaml index cfcf8fbbc3..19e4e10a60 100644 --- a/test/integration/manifests/cilium/v1.16/cilium-agent/templates/daemonset-dualstack.yaml +++ b/test/integration/manifests/cilium/v1.16/cilium-agent/templates/daemonset-dualstack.yaml @@ -17,10 +17,6 @@ spec: template: metadata: annotations: - container.apparmor.security.beta.kubernetes.io/apply-sysctl-overwrites: unconfined - container.apparmor.security.beta.kubernetes.io/cilium-agent: unconfined - container.apparmor.security.beta.kubernetes.io/clean-cilium-state: unconfined - container.apparmor.security.beta.kubernetes.io/mount-cgroup: unconfined prometheus.io/port: "9962" prometheus.io/scrape: "true" creationTimestamp: null @@ -97,6 +93,8 @@ spec: timeoutSeconds: 5 resources: {} securityContext: + appArmorProfile: + type: Unconfined capabilities: add: - CHOWN @@ -192,6 +190,8 @@ spec: name: mount-cgroup resources: {} securityContext: + appArmorProfile: + type: Unconfined capabilities: add: - SYS_ADMIN @@ -224,6 +224,8 @@ spec: name: apply-sysctl-overwrites resources: {} securityContext: + appArmorProfile: + type: Unconfined capabilities: add: - SYS_ADMIN @@ -282,6 +284,8 @@ spec: cpu: 100m memory: 100Mi securityContext: + appArmorProfile: + type: Unconfined capabilities: add: - NET_ADMIN diff --git a/test/integration/manifests/cilium/v1.16/cilium-agent/templates/daemonset.yaml b/test/integration/manifests/cilium/v1.16/cilium-agent/templates/daemonset.yaml index 952a0b7015..f2fb0ba89a 100644 --- a/test/integration/manifests/cilium/v1.16/cilium-agent/templates/daemonset.yaml +++ b/test/integration/manifests/cilium/v1.16/cilium-agent/templates/daemonset.yaml @@ -17,10 +17,6 @@ spec: template: metadata: annotations: - container.apparmor.security.beta.kubernetes.io/apply-sysctl-overwrites: unconfined - container.apparmor.security.beta.kubernetes.io/cilium-agent: unconfined - container.apparmor.security.beta.kubernetes.io/clean-cilium-state: unconfined - container.apparmor.security.beta.kubernetes.io/mount-cgroup: unconfined prometheus.io/port: "9962" prometheus.io/scrape: "true" creationTimestamp: null @@ -97,6 +93,8 @@ spec: timeoutSeconds: 5 resources: {} securityContext: + appArmorProfile: + type: Unconfined capabilities: add: - CHOWN @@ -192,6 +190,8 @@ spec: name: mount-cgroup resources: {} securityContext: + appArmorProfile: + type: Unconfined capabilities: add: - SYS_ADMIN @@ -224,6 +224,8 @@ spec: name: apply-sysctl-overwrites resources: {} securityContext: + appArmorProfile: + type: Unconfined capabilities: add: - SYS_ADMIN @@ -282,6 +284,8 @@ spec: cpu: 100m memory: 100Mi securityContext: + appArmorProfile: + type: Unconfined capabilities: add: - NET_ADMIN