Welcome to the v1.1.0 release of the security-profiles-operator!
This release brings AppArmor network policy support, health probes for the operator deployment, webhook tolerations, tighter SCC scoping, and numerous CRD validation improvements. The general usage and setup can be found in our documentation.
To install the operator, run:
$ kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/security-profiles-operator/v1.1.0/deploy/operator.yaml
The operator can also be installed with helm, and spoc, the official Security Profiles Operator Command Line Interface, is attached to this release for amd64, arm64, ppc64le and s390x.
All released artifacts are signed and the release assets carry SLSA build provenance. Verifying the released artifacts has the commands for the container images, the binaries, the SBOM and the helm chart.
Feel free to provide us any kind of feedback in the official Kubernetes Slack #security-profiles-operator channel.
What's Changed
API Changes
- Remove old API versions (v1alpha1, v1alpha2, v1beta1) by @saschagrunert in #3386
- Fix API consistency, error handling, security, observability, and performance issues by @saschagrunert in #3394
Feature
- helm: Add restrictToNamespace value by @saschagrunert in #3400
- Add configurable webhook tolerations by @saschagrunert in #3401
- CMP-4310: added dynamic TLS settings by @vickeybrown in #3190
- Publish runtime-spec seccomp profiles as KEP-6061 artifacts by @saschagrunert in #3421
- Publish the KEP-6061 test artifacts and cover the runtime format in e2e by @saschagrunert in #3427
- Publish the base profiles as versioned runtime format artifacts by @saschagrunert in #3429
- Validate runtime-spec profiles on push with the merge library by @saschagrunert in #3432
- Make artifact pushes reproducible and spoc tests hermetic by @saschagrunert in #3433
- Sign spoc artifacts with Sigstore bundles by @saschagrunert in #3447
- Push the helm chart to staging by @saschagrunert in #3450
- Attest the release assets and the Scorecard result by @saschagrunert in #3462
- Bump bom to v0.8.0 and switch SBOM to SPDX 3 by @saschagrunert in #3479
Bug
- fix(manager): avoid redundant profile status updates by @frayme in #3384
- Fix bugs, resource leaks, and logging across daemon packages by @saschagrunert in #3406
- Move webhook side effects to controllers by @saschagrunert in #3415
- Harden operator and webhook securityContext: runAsNonRoot, drop ALL by @KR-Ravindra in #3422
- Fix SPOd render aliasing, bpf recorder leaks and harden defaults by @saschagrunert in #3426
- Fix the duplicate -o flag on spoc pull by @saschagrunert in #3428
- Harden the artifact pull path by @saschagrunert in #3434
- fix: support RHEL OS images without release by @miltalex in #3435
- Set the target platform for per-arch images by @saschagrunert in #3445
- Verify only cosign signature bundles as signatures by @saschagrunert in #3449
- Reference the promoted bundle from the catalog by @saschagrunert in #3451
- Fix security, correctness, performance and CI findings from a full audit by @saschagrunert in #3467
- Make a chart install failure visible and test it in CI by @saschagrunert in #3472
- Only render SPOd hostPath volumes of enabled features by @KR-Ravindra in #3436
- Keep the symbol table so vulnerability scans stay truthful by @saschagrunert in #3482
Cleanup
- Build spoc for s390x and its SBOM in the build workflow by @saschagrunert in #3446
- Move the staging registry to k8s-staging-images by @saschagrunert in #3452
Other
- helm: Pin image tag and registry during release by @saschagrunert in #3424
- Bump version to v1.1.0 for release by @saschagrunert in #3485
New Contributors
- @frayme made their first contribution in #3384
- @KR-Ravindra made their first contribution in #3422
Full Changelog: v1.0.1...v1.1.0