kubelet >=v1.25: expose setting to enable the use of RuntimeDefault as the default seccomp profile for all workloads

[etungsten]

What I'd like:
A new settings.kubernetes setting for controlling whether --seccomp-default is passed to kubelet or not.

In K8s 1.25 SeccompDefault got promoted to beta which allows users to use a default seccomp profile for all their orchestrated container workloads.

See https://kubernetes.io/docs/tutorials/security/seccomp/#enable-the-use-of-runtimedefault-as-the-default-seccomp-profile-for-all-workloads:

If enabled, the kubelet will use the RuntimeDefault seccomp profile by default, which is defined by the container runtime, instead of using the Unconfined (seccomp disabled) mode. The default profiles aim to provide a strong set of security defaults while preserving the functionality of the workload.

[webern]

I haven't fully wrapped my head around all of this, but I hope we don't run into an issue with the: https://github.com/containerd/containerd/blob/d769f03592f11e6c0f06bdeeb64527c28f0ee984/pkg/cri/server/container_create_linux.go#L132

[etungsten]

I don't think there's any conflicts with the containerd logic when picking the runtime spec. With the flag enabled, Kubelet will use the default seccomp profile as defined by cri/containerd.

[zshen-figma]

Hello, do we have an estimate on when this will be implemented?

[cartrius-a]

Hi @zshen-figma, I've gone ahead and opened a PR (#3334) to add this to Bottlerocket.