'Permission denied' when using signal reboot mechanism to reboot AKS nodes about kured

[ckotzbauer]

I made it work in a test-environment with a pod-annotation for kured:

container.apparmor.security.beta.kubernetes.io/kured: unconfined

[andreas-wirth]

That did the trick, thanks. Also do not forget to put this annotation in the right place (inside the template section). And not in the DaemonSet annotations, as I did 😄

[ckotzbauer]

Thanks for opening this issue. Do you have an active apparmor installation on your host?

[andreas-wirth]

Thanks for the hint, apparmor is actually set to enabled as default on aks, I was not aware. Also seems like MS does not really have a good approach to easily initialise apparmor profiles on node scale-up. Here they suggest using a daemonset, I guess something like this implementation.

How are you dealing with this issue? Or are you just not using apparmor?
Not sure how other cloud providers handle apparmor configuration, but a short hint in the kured docs about it might be useful.