Security Profiles Operator release notes

In some instances when Security Profiles Operator (SPO) 0.9.0 was used with OKD version 4.20 and above, SPO would create the profilerecording resource but the workload would fail. Failure of the workload prevented the creation of the needed container for running the Operator. With the 0.10.0 release of SPO. the profilerecording resource is reliably created, therefore the needed container for running the Operator is reliably created. CMP-3537.

For version 0.9.0 of Security Profiles Operator (SPO), the spod pods would fail to run with the error message fsmount:fscontext:proc/: could not get mount id: operation not permitted. With the release of version 0.10.0, the spod pods run reliably. CMP-4007.

In releases of SPO 0.9.0 and earlier, there was a bug in syntax of the selinux usage. With this release of SPO, the change is from <policyName>_.process to <policyName>.process. The new syntax omits the _. Examples in the documentation now show this updated usage. CMP-4104

With the release of SPO v0.10.0, the Operator now supports Fedora CoreOS (FCOS) 10 containers. CMP-4033

In this release of the Security Profiles Operator, the Advanced Audit Logging Framework is available as a General Availability (GA) feature. The Advanced Audit Logging Framework uses the Audit JSON Log Enricher to capture and log terminal-based command activity in Fedora CoreOS (FCOS) containers, including oc rsh, oc exec, and oc debug commands.

Before this update, the spod pods could fail to start and enter into a CrashLoopBackOff state due to an error in parsing the semanage configuration file. This issue is caused by a change to the RHEL 9 image naming convention beginning in OKD 4.19. (OCPBUGS-55829)

Before this update, the Security Profiles Operator would fail to apply a RawSelinuxProfile to newly added nodes due to a reconciler type mismatch error. With this update, the operator now correctly handles RawSelinuxProfile objects and policies are applied to all nodes as expected. (OCPBUGS-33718)

When attempting to install the Security Profile Operator from the web console, the option to enable Operator-recommended cluster monitoring was unavailable for the namespace. With this update, you can now enabled Operator-recommend cluster monitoring in the namespace. (OCPBUGS-37794)

Previously, the Security Profiles Operator would intermittently be not visible in the OperatorHub, which caused limited access to install the Operator via the web console. With this update, the Security Profiles Operator is present in the OperatorHub.

You can now specify a default security profile in the image attribute of a ProfileBinding object by setting a wildcard. For more information, see Binding workloads to profiles with ProfileBindings (SELinux) and Binding workloads to profiles with ProfileBindings (Seccomp).

Previously, SELinuxProfile objects did not inherit custom attributes from the same namespace. With this update, the issue has now been resolved and SELinuxProfile object attributes are inherited from the same namespace as expected. (OCPBUGS-17164)

Previously, RawSELinuxProfiles would hang during the creation process and would not reach an Installed state. With this update, the issue has been resolved and RawSELinuxProfiles are created successfully. (OCPBUGS-19744)

Previously, patching the enableLogEnricher to true would cause the seccompProfile log-enricher-trace pods to be stuck in a Pending state. With this update, log-enricher-trace pods reach an Installed state as expected. (OCPBUGS-22182)

Previously, the Security Profiles Operator generated high cardinality metrics, causing Prometheus pods using high amounts of memory. With this update, the following metrics will no longer apply in the Security Profiles Operator namespace:

Previously, while trying to install Security Profiles Operator in a disconnected cluster, the secure hashes provided were incorrect due to a SHA relabeling issue. With this update, the SHAs provided work consistently with disconnected environments. (OCPBUGS-14404)

Security Profiles Operator (SPO) now automatically selects the appropriate selinuxd image for RHEL 8- and 9-based Fedora CoreOS (FCOS) systems.

You can now enable memory optimization inside of an spod daemon. For more information, see Enabling memory optimization in the spod daemon.

The daemon resource requirements are now configurable. For more information, see Customizing daemon resource requirements.

The priority class name is now configurable in the spod configuration. For more information, see Setting a custom priority class name for the spod daemon pod.

The default nginx-1.19.1 seccomp profile is now removed from the Security Profiles Operator deployment.

Previously, a Security Profiles Operator (SPO) SELinux policy did not inherit low-level policy definitions from the container template. If you selected another template, such as net_container, the policy would not work because it required low-level policy definitions that only existed in the container template. This issue occurred when the SPO SELinux policy attempted to translate SELinux policies from the SPO custom format to the Common Intermediate Language (CIL) format. With this update, the container template appends to any SELinux policies that require translation from SPO to CIL. Additionally, the SPO SELinux policy can inherit low-level policy definitions from any supported policy template. (OCPBUGS-12879)

When uninstalling the Security Profiles Operator, the MutatingWebhookConfiguration object is not deleted and must be manually removed. As a workaround, delete the MutatingWebhookConfiguration object after uninstalling the Security Profiles Operator. These steps are defined in Uninstalling the Security Profiles Operator. (OCPBUGS-4687)

When uninstalling the Security Profiles Operator, the MutatingWebhookConfiguration object is not deleted and must be manually removed. As a workaround, delete the MutatingWebhookConfiguration object after uninstalling the Security Profiles Operator. These steps are defined in Uninstalling the Security Profiles Operator. (OCPBUGS-4687)

When uninstalling the Security Profiles Operator, the MutatingWebhookConfiguration object is not deleted and must be manually removed. As a workaround, delete the MutatingWebhookConfiguration object after uninstalling the Security Profiles Operator. These steps are defined in Uninstalling the Security Profiles Operator. (OCPBUGS-4687)