Cannot enforce AppArmor: AppArmor is not enabled on the host

[divyanshursahu]

I am running 6 node talos cluster with 3 master and 3 worker node but when I deploy the manifest with apparmor profile enable I get
" Cannot enforce AppArmor: AppArmor is not enabled on the host ". Although I have added the below

extraKernelArgs:
      - -selinux
      - lsm=lockdown,capability,yama,apparmor,bpf
      - apparmor=1

Currenlty running: siderolabs/installer:v1.9.1
and above is set for all master and worker nodes, running on openstack cloud.
Also is there a way to verify even if this enabled or not. I am pretty new to talos and look around but could not find much.

[frezbo]

you'd first need to do an upgrade to same version of talos for extraKernelArgs to take effect, the resulting LSM's can verified by running talosctl read /sys/kernel/security/lsm

[divyanshursahu]

Thanks for the response. With the "upgrade to same version of talos" I did not understand do I need to move to an latest version like 1.9.3 or 1.9.4 ? for this thing to take effect ?

currently what I did is I put them on the worker.yaml file which comes out when we initiate talos with talos gen config ?
any command you would like to suggest or any documentation ?

[frezbo]

you can upgrade to same version of talos that is running if you don't want to upgrade

[divyanshursahu]

did the trick. Thanks