KubeArmor and LSM policies

As we mentioned, KubeArmor is a tool that helps you create policies for Linux LSMs. Since it creates standard LSMs, any policy that you create and deploy will be stored on the node(s) where the OS stores LSM policies. Since we are using KinD, the nodes are running Ubuntu, which uses AppArmor as the LSM. AppArmor policies are stored in the /etc/apparmor.d directory on the host.

The output below shows an example directory from a node that has had a few KubeArmor policies created:

kubearmor-local-path-storage-local-path-provisioner-local-path-provisioner
kubearmor-my-ext-secret-nginx-secrets-nginx-web
kubearmor-calico-apiserver-calico-apiserver-calico-apiserver             kubearmor-tigera-operator-tigera-operator-tigera-operator
kubearmor-calico-system-calico-kube-controllers-calico-kube-controllers  kubearmor-vault-vault-agent-injector-sidecar-injector
kubearmor-calico-system-calico-node-calico-node                          kubearmor-vault-vault-vault...