github kubernetes-sigs/security-profiles-operator v1.0.0
on GitHub

4 hours ago

Welcome to our glorious v1.0.0 release of the security-profiles-operator! 🥳 👯

This is the first stable release of the Security Profiles Operator! All CRD APIs have been graduated from alpha/beta to v1, providing a stable API surface for managing security profiles in Kubernetes. This release was preceded by a third-party security audit that found zero critical vulnerabilities, with all identified hardening areas addressed in this release. The general usage and setup can be found in our documentation, and a dedicated v1 migration guide is available to help with upgrading from previous versions.

To install the operator, run: 

$ kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/security-profiles-operator/v1.0.0/deploy/operator.yaml

You can also verify the container image signature by using cosign: 

$ cosign verify \
    --certificate-identity krel-trust@k8s-releng-prod.iam.gserviceaccount.com \
    --certificate-oidc-issuer https://accounts.google.com \
    registry.k8s.io/security-profiles-operator/security-profiles-operator:v1.0.0

Besides the operator image, we now also ship spoc, the official Security Profiles Operator Command Line Interface! Binaries for amd64, arm64 and ppc64le are attached to this release.

To verify the signature of spoc, download all release artifacts and run for amd64 (works in the same way for arm64 and ppc64le): 

$ cosign verify-blob \
    --certificate-identity sgrunert@redhat.com \
    --certificate-oidc-issuer https://github.com/login/oauth \
    --bundle spoc.amd64.bundle \
    spoc.amd64

We also provide .sha512 sum files for the binaries.

Feel free to provide us any kind of feedback in the official Kubernetes Slack #security-profiles-operator channel.

Changes by Kind

API Changes

Feature

  • Add enableInsecureMetricsAccess SPOD config option to allow unauthenticated metrics scraping on the daemon container. (#3265, @ccojocar)

Security

  • Sanitize all input data rendered into the AppArmor profile template. (#3233, @ccojocar)
  • Add safety bound check for path length in eBPF recorder. (#3264, @ccojocar)
  • Cap the maximum number of recorded files and the file path length in the BPF recorder to avoid OOM. (#3246, @ccojocar)
  • Fix data races, OOM guards, and performance in BPF recorder and container ID cache. (#3251, @saschagrunert)
  • Add kubebuilder validation for HostProcVolumePath to prevent mounting other paths than /proc. (#3236, @ccojocar)
  • Add kubebuilder validation for ListenerPath in SeccompProfile configuration. (#3239, @ccojocar)
  • Anchor the regex to match only the SPO_EXEC_REQUIRED_UID and not other arguments of the command. (#3237, @ccojocar)
  • Fix greedy operator in audit regexes. (#3238, @ccojocar)
  • Verify the base profile OIDC on immutable image digest and add options to SPOD config to setup allowed identity and OIDC issuer regexp(s). (#3252, @ccojocar)
  • Add SELinux semantic validation for dangerous types, classes and permissions. (#3261, @ccojocar)
  • Improve the SELinux policy validation to check unescaped ) and use of restrictive global directives. (#3258, @ccojocar)

Bug

  • Fix partial profiles never merged due to namespace filter. (#3241, @mirza-src)
  • Make selinuxd policy compatible with refpolicy. (#3259, @mirza-src)
  • Add default SELinux options so allowedSystemProfiles is applied. (#3243, @mirza-src)
  • Skip binding when a referenced profile is not available. (#3257, @ccojocar)
  • Make sure that the profiles are really bound when another profile exists in security context. (#3256, @ccojocar)
  • Webhook should overwrite an existing recording annotation on a pod. (#3244, @ccojocar)
  • Avoid overwriting existing AppArmor profiles. (#3225, @ccojocar)
  • Combine the pid with the start time of the process when caching the container ID. (#3247, @ccojocar)
  • Drop the labels with unbounded cardinality from Prometheus counters. (#3245, @ccojocar)
  • Chown emptyDir mounts via fsGroup so cosign TUF cache works. (#3163, @Ca-moes)
  • Fix SELinux policy reload job creation when SPOD pods are excluded from the daemon manager cache. (#3270, @miltalex)

Cleanup

Documentation

Dependencies

Added

  • github.com/aperturerobotics/protobuf-go-lite: v0.14.0
  • github.com/checkpoint-restore/go-criu/v8: v8.3.0
  • github.com/mistifyio/go-zfs/v4: v4.0.0
  • github.com/moby/sys/devices: v0.1.0
  • k8s.io/streaming: v0.36.2

Changed

Removed

  • github.com/checkpoint-restore/go-criu/v7: v7.2.0
  • github.com/containernetworking/cni: v1.3.0
  • github.com/containernetworking/plugins: v1.8.0
  • github.com/docker/docker: v28.5.1
  • github.com/gregjones/httpcache: 901d907
  • github.com/mistifyio/go-zfs/v3: v3.1.0
  • github.com/mndrix/tap-go: 629fa40
  • github.com/xeipuuv/gojsonschema: v1.2.0
Check out latest releases or
releases around kubernetes-sigs/security-profiles-operator v1.0.0

Don't miss a new security-profiles-operator release

NewReleases is sending notifications on new releases.

Get notifications