Render native AppArmor profiles on Kubernetes 1.30+

[freimer]

Summary

This updates the keeper-gateway chart so the existing appArmorProfile value can render the native Kubernetes container securityContext.appArmorProfile field when Helm renders against Kubernetes 1.30 or later.

The chart continues to emit the legacy container.apparmor.security.kubernetes.io/gateway pod annotation for compatibility with Kubernetes versions before 1.30.

Motivation

The current chart only emits the legacy AppArmor pod annotation. On Kubernetes 1.30+ clusters, including Ubuntu 24.04/k3s environments, the native container appArmorProfile field may be required for the gateway container to actually run under the intended local AppArmor profile.

Without the native field, a hardened gateway deployment can appear correctly configured while /proc/1/attr/current still reports unconfined, which can break RBI/CEF startup under AppArmor.

Changes

• Added a helper that translates appArmorProfile values into native Kubernetes AppArmor profile objects:
  • unconfined -> type: Unconfined
  • runtime/default -> type: RuntimeDefault
  • localhost/<profile> -> type: Localhost and localhostProfile: <profile>
• Added Kubernetes version gating so native securityContext.appArmorProfile only renders for Kubernetes 1.30+.
• Preserved the existing legacy AppArmor annotation for older cluster compatibility.
• Updated README and values comments to document the version-gated behavior and runtime verification command.
• Bumped the keeper-gateway chart version to 0.2.1.

Validation

• helm lint charts/keeper-gateway
• helm template kg charts/keeper-gateway --show-only templates/deployment.yaml --kube-version 1.29.0 --set appArmorProfile=localhost/gateway-apparmor-profile
  • Confirmed legacy AppArmor annotation renders.
  • Confirmed native securityContext.appArmorProfile does not render.
• helm template kg charts/keeper-gateway --show-only templates/deployment.yaml --kube-version 1.30.0 --set appArmorProfile=localhost/gateway-apparmor-profile
  • Confirmed legacy AppArmor annotation renders.
  • Confirmed native securityContext.appArmorProfile.type: Localhost and localhostProfile: gateway-apparmor-profile render.
• helm template kg charts/keeper-gateway --show-only templates/deployment.yaml --kube-version 1.30.0 --set appArmorProfile=runtime/default
  • Confirmed native type: RuntimeDefault renders.
• helm template kg charts/keeper-gateway --show-only templates/deployment.yaml --kube-version 1.30.0 --set appArmorProfile=unconfined
  • Confirmed native type: Unconfined renders.
• git diff --check

Deployment And Rollback

Risk is low. The native field is gated to Kubernetes 1.30+ and the legacy annotation remains in place for all supported chart render paths.

Rollback by reverting commit 8e558edcbb02717a68dba72597d529790192baa5.

[freimer]

Sorry, I needed to publish on my gh-pages, and pushed to the wrong branch. I reverted to the original PR.

[maksimu]

Looks good !