<p>Can I enable, on the cluster level, for the pods to use default secomp and apparmor profiles or do I need to make an admission controller of my own to insert the innotation to the objects? </p>

<p>Leaving it to users is not an option.</p>

Ijaz Ahmad
<p>There is already the <a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/" rel="nofollow noreferrer"><code>PodSecurityPolicy</code></a> object which essentially is an implementation of an admission controller. You can control the <a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp" rel="nofollow noreferrer"><code>seccomp</code></a> and <a href="https://kubernetes.io/docs/tutorials/clusters/apparmor/#podsecuritypolicy-annotations" rel="nofollow noreferrer"><code>apparmor</code></a> profiles using annotations in the PodSecurityPolicy:</p>

<p>For example (as described in the <a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/#example-policies" rel="nofollow noreferrer">docs</a>), notice the 'default' in the annotation:</p>

<pre><code>apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: restricted
  annotations:
    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
    apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
    seccomp.security.alpha.kubernetes.io/defaultProfileName:  'docker/default'
    apparmor.security.beta.kubernetes.io/defaultProfileName:  'runtime/default'
spec:
...
</code></pre>

<p>Note that <a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp" rel="nofollow noreferrer">Seccomp</a> is alpha and <a href="https://kubernetes.io/docs/tutorials/clusters/apparmor/" rel="nofollow noreferrer">Apparmor</a> is beta as of this writing.</p>
