Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Made changes in support_matix.md about Amazon Linux 2 by HariVamsiK #1016

Closed
wants to merge 1 commit into from
Closed

Made changes in support_matix.md about Amazon Linux 2 by HariVamsiK #1016

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions getting-started/support_matrix.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,8 @@ Amazon Linux 2 currently is shipped with SELinux as the LSM (Linux Security Modu

The latest versions of Amazon Linux 2 ship with a new LSM type called BPF-LSM and Kubearmor [intends](https://github.com/kubearmor/KubeArmor/issues/484) to support it soon).

Update: On Amazon Linux 2 with Kernel Version 5.10, Kubearmor is found to be running on systemd mode. The enforcement is sometimes partial with following supported LSM's: "Capability,Yama,Lockdown,SELinux,BPF". Refer [Issue](https://github.com/kubearmor/KubeArmor/issues/919).

Comment on lines +28 to +29
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @HariVamsiK, what does it mean by "enforcement is sometimes partial"?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The issue was solved when I installed a previous version of kubearmor first, then removed it and installed the new version and doing a daemon reload. The command "kubearmor probe" gave the output as enforcement as partial when I installed the new version directly.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay, the enforcement as Partial is not correct. In Amazon Linux-2, AppArmor is not available and in karmor probe we are only watching for AppArmor. We should ideally be also watching for BPF LSM too and we already have an issue for that here: kubearmor/kubearmor-client#211
Except that, in the screenshot you shared, KubeArmor is not running in the first place. The probe is just giving a note that enforcement will work if KubeArmor runs successfully.
Now with issue #919 user mentioned that they were not able to run KubeArmor v0.6 on AL-2. Can you confirm if you were able to successfully deploy KubeArmor (v0.6) or the latest version in systemd mode?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can confirm that I was able to successfully deploy KubeArmor(v0.6) in systemd mode. The following screenshot depicts the same.
2

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you also confirm for the latest KubeArmor version?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah it's working with the latest version of kubearmor V0.7.2
4

### Platform I am interested is not listed here! What can I do?

Please approach the Kubearmor community on [slack](https://github.com/kubearmor/kubearmor#slack) or [raise](https://github.com/kubearmor/KubeArmor/issues/new/choose) a GitHub issue to express interest in adding the support.
Expand Down