From 8cb66313e778163a161fd5bab47c6f029f6d440a Mon Sep 17 00:00:00 2001 From: Haihan Jiang Date: Sun, 24 May 2026 04:41:26 -0700 Subject: [PATCH] Migrate Beyla AppArmor profile --- recipes/beyla-golden-signals/gke/beyla-daemonset.yaml | 7 +++---- recipes/beyla-service-graph/beyla-daemonset.yaml | 7 +++---- 2 files changed, 6 insertions(+), 8 deletions(-) diff --git a/recipes/beyla-golden-signals/gke/beyla-daemonset.yaml b/recipes/beyla-golden-signals/gke/beyla-daemonset.yaml index 0c5ec36..420df03 100644 --- a/recipes/beyla-golden-signals/gke/beyla-daemonset.yaml +++ b/recipes/beyla-golden-signals/gke/beyla-daemonset.yaml @@ -26,10 +26,6 @@ spec: metadata: labels: app: beyla - annotations: - # allow beyla to write to /sys/fs/bpf by setting the - # apparmor policy to unconfined. - container.apparmor.security.beta.kubernetes.io/beyla: "unconfined" spec: serviceAccountName: beyla hostPID: true @@ -66,6 +62,9 @@ spec: memory: 100Mi image: grafana/beyla:1.8.6 securityContext: + # Allow Beyla to write to /sys/fs/bpf. + appArmorProfile: + type: Unconfined seccompProfile: type: RuntimeDefault runAsUser: 0 diff --git a/recipes/beyla-service-graph/beyla-daemonset.yaml b/recipes/beyla-service-graph/beyla-daemonset.yaml index aa223e4..4ce06cc 100644 --- a/recipes/beyla-service-graph/beyla-daemonset.yaml +++ b/recipes/beyla-service-graph/beyla-daemonset.yaml @@ -26,10 +26,6 @@ spec: metadata: labels: app: beyla - annotations: - # allow beyla to write to /sys/fs/bpf by setting the - # apparmor policy to unconfined. - container.apparmor.security.beta.kubernetes.io/beyla: "unconfined" spec: serviceAccountName: beyla hostPID: true @@ -66,6 +62,9 @@ spec: memory: 100Mi image: grafana/beyla:1.8.6 securityContext: + # Allow Beyla to write to /sys/fs/bpf. + appArmorProfile: + type: Unconfined seccompProfile: type: RuntimeDefault runAsUser: 0