AppArmor를 사용하면 시스템 관리자가 배포된 컨테이너의 기능을 제한할 수 있습니다. 마이그레이션된 컨테이너 워크로드를 배포하려면 Migrate to Containers를 사용하려면 Linux LXC 패키지에서 제공하는 AppArmor 프로필이 필요합니다.
하지만 Google Kubernetes Engine(GKE) 1.20으로 업데이트할 때 Ubuntu 노드 이미지에는 LXC 패키지가 더 이상 기본적으로 포함되지 않습니다. 즉, 기존 클러스터에 대해 GKE 1.20 이상으로 업그레이드된 Ubuntu 노드를 사용하는 새 배포 클러스터는 마이그레이션된 워크로드를 실행할 수 없습니다.
GKE 버전 1.20 이상의 Ubuntu 노드에 컨테이너 워크로드를 배포하면 워크로드가 비정상 종료 루프로 전환될 수 있으며 로그에 다음 형식의 오류 메시지가 포함됩니다.
D0806 01:59:15.000000 8 hcutil.py:136] SHELL CMD:aa-exec -p lxc-container-default echo 123D0806 01:59:15.000000 8 hcutil.py:168] SHELL STDERR:b"aa-exec: ERROR:profile 'lxc-container-default' does not exist\n"D0806 01:59:15.000000 8 hcutil.py:168] SHELL STDERR:b'\n'D0806 01:59:15.000000 8 hcutil.py:210] SHELL COMPLETED:1 (aa-exec -p lxc-container-default echo 123)required AppArmor profile 'lxc-container-default' does not exist, if this pod runs on aGKE node of type 'Container Optimized OS' (COS) please run`migctl setup install --cos-runtime` to install itE0806 01:59:15.000000 8 hcmain.py:22] Traceback (most recent call last):File "./hcmain.py", line 19, in safe_actionFile "./hcmain.py", line 74, in run_actionFile "./hcrunner.py", line 392, in validateSystemException:Invalid system or AppArmor profileE0806 01:59:15.000000 8 hcmain.py:23] Invalid system or AppArmor profileI0806 01:59:15.000000 8 termination_log.py:4] writing error to termination log at /dev/termination-log
이 문제를 해결하려면 다음 단계를 따르세요.
다음 형식의 명령어를 사용하여 배포 클러스터에 연결합니다.
gcloud container clusters get-credentials CLUSTER --zone ZONE --project PROJECT
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["# Migrated workload fails on 1.20 and later with Ubuntu nodes\n===========================================================\n\n[AppArmor](https://apparmor.net/) lets a system administrator\nrestrict capabilities of a deployed container. To deploy a migrated container workload,\nMigrate to Containers requires the AppArmor profile provided by the Linux LXC package.\n\nHowever, as part of the update to Google Kubernetes Engine (GKE) 1.20, Ubuntu node images\nno longer include the LXC package by default. That means new deployment clusters that\nuse Ubuntu nodes, or Ubuntu nodes for existing deployment clusters\nthat are upgraded to GKE 1.20 and later, cannot run your migrated workloads.\n\nWhen deploying container workloads on Ubuntu nodes for GKE\nversions 1.20 and later, the workload can enter a crash-loop and the logs contain\nerror messages in the form: \n\n```yaml\nD0806 01:59:15.000000 8 hcutil.py:136] SHELL CMD: aa-exec -p lxc-container-default echo 123\nD0806 01:59:15.000000 8 hcutil.py:168] SHELL STDERR: b\"aa-exec: ERROR: profile 'lxc-container-default' does not exist\\n\"\nD0806 01:59:15.000000 8 hcutil.py:168] SHELL STDERR: b'\\n'\nD0806 01:59:15.000000 8 hcutil.py:210] SHELL COMPLETED: 1 (aa-exec -p lxc-container-default echo 123)\nrequired AppArmor profile 'lxc-container-default' does not exist, if this pod runs on a\nGKE node of type 'Container Optimized OS' (COS) please run\n`migctl setup install --cos-runtime` to install it\nE0806 01:59:15.000000 8 hcmain.py:22] Traceback (most recent call last):\n File \"./hcmain.py\", line 19, in safe_action\n File \"./hcmain.py\", line 74, in run_action\n File \"./hcrunner.py\", line 392, in validateSystem\nException: Invalid system or AppArmor profile\n\nE0806 01:59:15.000000 8 hcmain.py:23] Invalid system or AppArmor profile\nI0806 01:59:15.000000 8 termination_log.py:4] writing error to termination log at /dev/termination-log\n```\n\nTo resolve this issue:\n\n1. Connect to the deployment cluster using a command in the form:\n\n ```\n gcloud container clusters get-credentials CLUSTER --zone ZONE --project PROJECT\n ```\n2. Manually install the Linux LXC package on the deployment cluster by using the command:\n\n ```\n migctl setup install --cos-runtime\n ```"]]
