Disable AppArmor

[cedricmckinnie]

I ran into "permission denied" errors within some of the daemon pod containers even when running them as root. I found that disabling AppArmor on the config-reloader and keepalived containers resolved the issue. What do you think?

[cedricmckinnie]

@raffaelespazzoli Does this one seem like a good addition?

[raffaelespazzoli]

I am not familiar with apparmor. That said disabling security by default does not seem like a good idea to me. Why don't you add a chart variable to disable arm and then put those two annotation under a conditional.

[cedricmckinnie]

That's fair. I'll add an extra value to the CRD so it works even without helm.

[cedricmckinnie]

Added an extra property and tested. Ready for re-review.

[raffaelespazzoli]

Instead of modeling this feature this was, can you add a generic annotations field. Those annotations will be applied verbatim to the keepalived pod?

[cedricmckinnie]

@raffaelespazzoli smart. Ready for re-review.

[cedricmckinnie]

Ready for re-review

[cedricmckinnie]

@raffaelespazzoli just checking in. Look good to you?

[raffaelespazzoli]

this is till going to fail there are no annotations. the empty annotations: will make it fail. it should look like what helm generates by default:

    {{- with .Values.podAnnotations }}
      annotations:
        {{- toYaml . | nindent 8 }}
    {{- end }}

[cedricmckinnie]

That worked actually. Please review. Thanks!

[raffaelespazzoli]

@cedricmckinnie please let me know if you need me to cut a new release

[cedricmckinnie]

@raffaelespazzoli Please do. Thanks!

[raffaelespazzoli]

v1.5.1 is on its way

[cedricmckinnie]

@raffaelespazzoli https://github.com/redhat-cop/keepalived-operator/issues/103