Welcome to the v1.0.1 release of the security-profiles-operator!
This is a patch release which adds new features like podSelector support for ProfileBinding, custom SELinux templates, SELinux allowlist options, and per-syscall coverage on merged seccomp profiles. It also includes several bug fixes and dependency updates. The general usage and setup can be found in our documentation.
To install the operator, run:
$ kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/security-profiles-operator/v1.0.1/deploy/operator.yaml
You can also verify the container image signature by using cosign:
$ cosign verify \
--certificate-identity krel-trust@k8s-releng-prod.iam.gserviceaccount.com \
--certificate-oidc-issuer https://accounts.google.com \
registry.k8s.io/security-profiles-operator/security-profiles-operator:v1.0.1
Besides the operator image, we now also ship spoc, the official Security Profiles Operator Command Line Interface! Binaries for amd64, arm64, ppc64le and s390x are attached to this release.
To verify the signature of spoc, download all release artifacts and run for amd64 (works in the same way for arm64, ppc64le and s390x):
$ cosign verify-blob \
--certificate-identity sgrunert@redhat.com \
--certificate-oidc-issuer https://github.com/login/oauth \
--bundle spoc.amd64.bundle \
spoc.amd64
We also provide .sha512 sum files for the binaries.
Feel free to provide us any kind of feedback in the official Kubernetes Slack #security-profiles-operator channel.
Changes by Kind
Feature
- Add podSelector to ProfileBinding for targeted pod matching. (#3287, @mirza-src)
- Add allowlist in SELinux options to override default denylist. (#3288, @mirza-src)
- Add SELinux options in helm chart. (#3321, @mirza-src)
- Add support for custom SELinux templates, including helm chart support, event logging, and DNS subdomain pattern validation. (#3357, @mirza-src)
- Expose per-syscall coverage on merged seccomp profiles. (#3355, @idriss-eliguene)
- Include profile kind in node status naming and validate SELinux profile names. (#3376, @saschagrunert)
- Use security-profiles-merger for seccomp and AppArmor union. (#3271, @saschagrunert)
Bug
- Add default SELinux options to v1 API so allowedSystemProfiles is applied. (#3276, @mirza-src)
- Skip binding mutation on pod UPDATE. (#3304, @saschagrunert)
- Ensure selinux.enable takes precedence over enableSelinux and quote SELinux typeTag in helm chart. (#3321, @mirza-src)
- Avoid merged profile name collision. (#3377, @idriss-eliguene)
- Allow metrics socket access in bpfrecorder AppArmor profile. (#3363, @saschagrunert)
Dependencies
Added
- filippo.io/mldsa: 43d0283
- github.com/ProtonMail/go-crypto: v1.4.1
- github.com/ThalesGroup/crypto11: v1.6.0
- github.com/cloudflare/circl: v1.6.3
- github.com/go-openapi/runtime/server-middleware: v0.30.0
- github.com/saschagrunert/security-profiles-merger: v0.3.6
- github.com/tink-crypto/tink-go-awskms/v3: v3.0.0
- github.com/vbauerster/cupwriter: v0.0.4
Changed
- cel.dev/expr: v0.25.1 → v0.25.2
- chainguard.dev/go-grpc-kit: v0.17.15 → v0.17.17
- chainguard.dev/sdk: v0.1.45 → v0.1.55
- cloud.google.com/go/auth: v0.18.2 → v0.20.0
- cloud.google.com/go/iam: v1.5.3 → v1.11.0
- cloud.google.com/go/kms: v1.26.0 → v1.31.0
- cloud.google.com/go/longrunning: v0.8.0 → v1.0.0
- cloud.google.com/go/monitoring: v1.24.3 → v1.25.0
- cloud.google.com/go/profiler: v0.4.3 → v0.6.0
- cloud.google.com/go/pubsub: v1.50.1 → v1.50.2
- cloud.google.com/go/pubsub/v2: v2.3.0 → v2.6.0
- cloud.google.com/go/security: v1.19.2 → v1.25.0
- cloud.google.com/go/spanner: v1.87.0 → v1.91.0
- cloud.google.com/go/storage: v1.59.2 → v1.62.2
- github.com/Azure/azure-sdk-for-go/sdk/azcore: v1.21.0 → v1.22.0
- github.com/Azure/azure-sdk-for-go/sdk/azidentity: v1.13.1 → v1.14.0
- github.com/Azure/azure-sdk-for-go/sdk/internal: v1.11.2 → v1.12.0
- github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys: v1.4.0 → v1.5.0
- github.com/Azure/go-ntlmssp: 754e693 → v0.1.1
- github.com/AzureAD/microsoft-authentication-library-for-go: v1.7.0 → v1.7.2
- github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp: v1.5.3 → v1.6.0
- github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp: v1.31.0 → v1.33.0
- github.com/Venafi/vcert/v5: v5.12.3 → v5.13.7
- github.com/akamai/AkamaiOPEN-edgegrid-golang/v13: v13.0.0 → v13.2.0
- github.com/aperturerobotics/protobuf-go-lite: v0.14.0 → v0.15.0
- github.com/aquasecurity/libbpfgo: 1.5.1 → 2bbc483
- github.com/aws/aws-sdk-go-v2: v1.41.4 → v1.42.0
- github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: v1.7.4 → v1.7.10
- github.com/aws/aws-sdk-go-v2/config: v1.32.12 → v1.32.25
- github.com/aws/aws-sdk-go-v2/credentials: v1.19.12 → v1.19.24
- github.com/aws/aws-sdk-go-v2/feature/ec2/imds: v1.18.20 → v1.18.29
- github.com/aws/aws-sdk-go-v2/internal/configsources: v1.4.20 → v1.4.29
- github.com/aws/aws-sdk-go-v2/internal/endpoints/v2: v2.7.20 → v2.7.29
- github.com/aws/aws-sdk-go-v2/internal/v4a: v1.4.17 → v1.4.30
- github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding: v1.13.7 → v1.13.12
- github.com/aws/aws-sdk-go-v2/service/internal/checksum: v1.9.8 → v1.9.15
- github.com/aws/aws-sdk-go-v2/service/internal/presigned-url: v1.13.20 → v1.13.29
- github.com/aws/aws-sdk-go-v2/service/internal/s3shared: v1.19.17 → v1.19.23
- github.com/aws/aws-sdk-go-v2/service/kms: v1.50.3 → v1.52.0
- github.com/aws/aws-sdk-go-v2/service/route53: v1.62.2 → v1.63.3
- github.com/aws/aws-sdk-go-v2/service/s3: v1.96.0 → v1.101.0
- github.com/aws/aws-sdk-go-v2/service/signin: v1.0.8 → v1.2.0
- github.com/aws/aws-sdk-go-v2/service/sso: v1.30.13 → v1.31.3
- github.com/aws/aws-sdk-go-v2/service/ssooidc: v1.35.17 → v1.36.6
- github.com/aws/aws-sdk-go-v2/service/sts: v1.41.9 → v1.43.3
- github.com/aws/smithy-go: v1.24.2 → v1.27.3
- github.com/cert-manager/cert-manager: v1.20.2 → v1.21.1
- github.com/checkpoint-restore/go-criu/v8: v8.3.0 → v8.4.0
- github.com/containers/ocicrypt: v1.3.0 → v1.3.2
- github.com/coreos/go-oidc/v3: v3.17.0 → v3.18.0
- github.com/digitalocean/godo: v1.176.0 → v1.197.0
- github.com/docker/cli: v29.5.3 → v29.7.2
- github.com/docker/docker-credential-helpers: v0.9.7 → v0.9.8
- github.com/docker/go-connections: v0.7.0 → v0.8.1
- github.com/go-chi/chi/v5: v5.2.5 → v5.3.0
- github.com/go-jose/go-jose/v3: v3.0.4 → v3.0.5
- github.com/go-ldap/ldap/v3: v3.4.12 → v3.4.13
- github.com/go-logr/logr: v1.4.3 → v1.4.4
- github.com/go-openapi/analysis: v0.24.3 → v0.25.2
- github.com/go-openapi/jsonreference: v0.21.5 → v0.21.6
- github.com/go-openapi/runtime: v0.29.3 → v0.32.3
- github.com/go-openapi/spec: v0.22.4 → v0.22.5
- github.com/go-openapi/strfmt: v0.26.1 → v0.26.3
- github.com/go-openapi/testify/enable/yaml/v2: v2.4.2 → v2.5.1
- github.com/go-openapi/testify/v2: v2.4.2 → v2.5.1
- github.com/go-openapi/validate: v0.25.2 → v0.25.3
- github.com/go-piv/piv-go/v2: v2.5.0 → v2.6.0
- github.com/go-playground/validator/v10: v10.30.2 → v10.30.3
- github.com/google/cel-go: v0.27.0 → v0.29.0
- github.com/google/go-containerregistry: v0.21.7 → v0.22.0
- github.com/google/trillian: v1.7.2 → v1.7.3
- github.com/google/wire: v0.6.0 → v0.7.0
- github.com/googleapis/enterprise-certificate-proxy: v0.3.14 → v0.3.16
- github.com/googleapis/gax-go/v2: v2.19.0 → v2.22.0
- github.com/grpc-ecosystem/grpc-gateway/v2: v2.28.0 → v2.29.0
- github.com/hashicorp/vault/api: v1.22.0 → v1.23.0
- github.com/hashicorp/vault/sdk: v0.23.0 → v0.25.1
- github.com/in-toto/attestation: v1.1.2 → v1.2.0
- github.com/jellydator/ttlcache/v3: v3.4.0 → v3.4.1
- github.com/klauspost/compress: v1.18.6 → v1.19.2
- github.com/letsencrypt/boulder: v0.20260303.0 → v0.20260309.0
- github.com/mailru/easyjson: v0.9.1 → v0.7.7
- github.com/mattn/go-runewidth: v0.0.23 → v0.0.27
- github.com/mattn/go-sqlite3: v1.14.44 → v1.14.48
- github.com/moby/moby/api: v1.54.2 → v1.55.0
- github.com/moby/moby/client: v0.4.1 → v0.5.1
- github.com/moby/sys/user: v0.4.0 → v0.4.1
- github.com/onsi/ginkgo/v2: v2.29.0 → v2.32.0
- github.com/onsi/gomega: v1.41.0 → v1.42.1
- github.com/opencontainers/cgroups: v0.0.6 → v0.0.8
- github.com/opencontainers/runc: v1.5.0 → v1.5.1
- github.com/opencontainers/selinux: v1.14.1 → v1.15.1
- github.com/pkg/sftp: v1.13.10 → v1.13.11
- github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring: v0.92.0 → v0.93.1
- github.com/prometheus/client_golang: v1.23.2 → v1.24.1
- github.com/prometheus/common: v0.67.5 → v0.70.1
- github.com/prometheus/procfs: v0.20.1 → v0.21.1
- github.com/redis/go-redis/v9: v9.17.2 → v9.18.0
- github.com/sigstore/cosign/v2: v2.6.3 → v2.6.5
- github.com/sigstore/fulcio: v1.8.5 → v1.8.7
- github.com/sigstore/protobuf-specs: v0.5.0 → v0.5.1
- github.com/sigstore/rekor: v1.5.0 → v1.5.2
- github.com/sigstore/rekor-tiles/v2: v2.2.1 → 5d098a2
- github.com/sigstore/sigstore: v1.10.6 → v1.10.8
- github.com/sigstore/sigstore-go: v1.1.4 → v1.2.1
- github.com/sigstore/sigstore/pkg/signature/kms/aws: v1.10.5 → v1.10.8
- github.com/sigstore/sigstore/pkg/signature/kms/azure: v1.10.5 → v1.10.8
- github.com/sigstore/sigstore/pkg/signature/kms/gcp: v1.10.5 → v1.10.8
- github.com/sigstore/sigstore/pkg/signature/kms/hashivault: v1.10.5 → v1.10.8
- github.com/sigstore/timestamp-authority/v2: v2.0.6 → v2.1.2
- github.com/smallstep/pkcs7: v0.1.1 → v0.2.1
- github.com/spiffe/go-spiffe/v2: v2.6.0 → v2.7.0
- github.com/stoewer/go-strcase: v1.3.1 → v1.3.0
- github.com/stretchr/objx: v0.5.2 → v0.5.3
- github.com/stretchr/testify: v1.11.1 → v1.12.1
- github.com/sylabs/sif/v2: v2.24.0 → v2.24.1
- github.com/theupdateframework/go-tuf/v2: v2.4.1 → 7e8f69f
- github.com/tink-crypto/tink-go-hcvault/v2: v2.4.0 → v2.5.0
- github.com/transparency-dev/formats: v0.1.0 → v0.1.1
- github.com/ulikunitz/xz: v0.5.15 → v0.5.16
- github.com/vbauerster/mpb/v8: v8.12.0 → v8.14.0
- go.etcd.io/bbolt: v1.4.3 → v1.5.0
- go.opentelemetry.io/contrib/detectors/gcp: v1.42.0 → v1.44.0
- go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc: v0.66.0 → v0.67.0
- go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp: v0.68.0 → v0.69.0
- go.opentelemetry.io/otel: v1.43.0 → v1.44.0
- go.opentelemetry.io/otel/exporters/otlp/otlptrace: v1.41.0 → v1.42.0
- go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc: v1.41.0 → v1.42.0
- go.opentelemetry.io/otel/exporters/prometheus: v0.62.0 → v0.65.0
- go.opentelemetry.io/otel/metric: v1.43.0 → v1.44.0
- go.opentelemetry.io/otel/sdk: v1.43.0 → v1.44.0
- go.opentelemetry.io/otel/sdk/metric: v1.43.0 → v1.44.0
- go.opentelemetry.io/otel/trace: v1.43.0 → v1.44.0
- go.opentelemetry.io/proto/otlp: v1.9.0 → v1.10.0
- go.podman.io/common: v0.68.0 → v0.69.1
- go.podman.io/image/v5: v5.40.0 → v5.41.0
- go.podman.io/storage: v1.63.0 → v1.64.0
- go.step.sm/crypto: v0.77.2 → v0.81.0
- go.uber.org/zap: v1.27.1 → v1.28.0
- go.yaml.in/yaml/v3: v3.0.4 → v3.0.5
- goa.design/goa/v3: v3.23.4 → v3.26.0
- gocloud.dev: v0.40.0 → v0.45.0
- golang.org/x/crypto: v0.53.0 → v0.55.0
- golang.org/x/mod: v0.37.0 → v0.40.0
- golang.org/x/net: v0.56.0 → v0.58.0
- golang.org/x/sync: v0.21.0 → v0.22.0
- golang.org/x/sys: v0.46.0 → v0.47.0
- golang.org/x/telemetry: fb80ec8 → a038080
- golang.org/x/term: v0.44.0 → v0.45.0
- golang.org/x/text: v0.38.0 → v0.41.0
- golang.org/x/tools: v0.46.0 → v0.49.0
- google.golang.org/api: v0.272.0 → v0.286.0
- google.golang.org/genproto: 0b37fe3 → d00831a
- google.golang.org/genproto/googleapis/api: 9d38bb4 → 3dc84a4
- google.golang.org/genproto/googleapis/bytestream: 84a4fc4 → 7ab31c2
- google.golang.org/genproto/googleapis/rpc: 9d38bb4 → 7ab31c2
- google.golang.org/grpc: v1.81.1 → v1.83.1
- google.golang.org/protobuf: f2248ac → v1.36.12
- gopkg.in/ini.v1: v1.67.1 → v1.67.2
- k8s.io/api: v0.36.2 → v0.36.4
- k8s.io/apiextensions-apiserver: v0.36.2 → v0.36.3
- k8s.io/apimachinery: v0.36.2 → v0.36.4
- k8s.io/apiserver: v0.36.2 → v0.36.3
- k8s.io/cli-runtime: v0.36.2 → v0.36.4
- k8s.io/client-go: v0.36.2 → v0.36.4
- k8s.io/code-generator: v0.36.2 → v0.36.3
- k8s.io/component-base: v0.36.2 → v0.36.3
- k8s.io/kms: v0.36.2 → v0.36.3
- k8s.io/kube-aggregator: v0.35.2 → v0.36.2
- k8s.io/streaming: v0.36.2 → v0.36.4
- k8s.io/utils: ff6756f → be93311
- oras.land/oras-go/v2: v2.6.1 → v2.6.2
- sigs.k8s.io/gateway-api: v1.5.0 → v1.6.0
- software.sslmate.com/src/go-pkcs12: v0.7.0 → v0.7.2