kubernetes-sigs/security-profiles-operator v1.1.2 on GitHub

Welcome to the v1.1.2 release of the security-profiles-operator!

This is a patch release with many fixes in the controllers, the node daemon, the recorders and log enrichers, the admission webhooks and spoc, narrower RBAC for the operator and the daemon, fixes for AppArmor profiles on newer AppArmor userspace and with the BPF recorder, and the new spoc sign. It is built with Go 1.27.3, which fixes the vulnerabilities the scan of the v1.1.1 images found (#3576). The operator bundle, the catalog and the security profiles now get SLSA Build L3 provenance like the images, spoc and the Helm chart, and the SBOMs use the SPDX 3 predicate type. It is the first release whose promotion to registry.k8s.io requires SLSA Build L3 provenance from the release workflows for every artifact. The general usage and setup can be found in our documentation.

Fixed issues:

The daemon no longer crash-loops with invalid profile format on hosts with AppArmor userspace 4.0 or later, for example Ubuntu 25.10 and 26.04 (#3364, fixed by #3555).
ProfileRecordings with the BPF recorder can create AppArmorProfiles, which the AppArmor profile of the bpf-recorder blocked (#3554, fixed by #3556).
The daemon can save AppArmor profiles to the nodes, which its own AppArmor profile blocked (#3609, fixed by #3610).

Before upgrading, check these changes:

Metrics access moves from the default ServiceAccount to the new spo-metrics-client ServiceAccount, with its token in the spo-metrics-client-token Secret. Scrapers that use the metrics-token Secret must switch to the new Secret or to kubectl create token spo-metrics-client (#3549).
The Helm chart rejects unknown values (#3549).
SelinuxProfiles that use the CIL keywords all, and, not, or, range or xor as permissions are rejected, because they bypassed the denied permissions (#3592). SelinuxProfiles in the Permissive mode bypass the SELinux denylist as well; set the new SPOD option spec.selinux.options.allowPermissiveProfiles to false to reject them (#3613).
New SecurityProfilesOperatorDaemons must be named spod (#3568).

To install the operator, run:

$ kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/security-profiles-operator/v1.1.2/deploy/operator.yaml

The operator can also be installed with helm, and spoc, the official Security Profiles Operator Command Line Interface, is attached to this release for amd64, arm64, ppc64le and s390x. Both are published as OCI artifacts to registry.k8s.io/security-profiles-operator as well.

All released artifacts are signed and the release assets carry SLSA build provenance. Verifying the released artifacts has the commands for the container images, the binaries, the SBOM and the helm chart.

Feel free to provide us any kind of feedback in the official Kubernetes Slack #security-profiles-operator channel.

What's Changed

API Changes

Fix manager, webhook and manifest issues, move metrics access to a dedicated account by @saschagrunert in #3549
Fix control plane status, webhook and SPOD issues by @saschagrunert in #3568
Fix control plane webhook, tracker, spod write and API validation issues by @saschagrunert in #3580
Fix AppArmor binding bypass, SELinux denylist bypass and control plane bugs by @saschagrunert in #3592
Fix recording vs binding, SELinux policy and control plane issues by @saschagrunert in #3613

Feature

Fix spoc and OCI artifact signing issues, add spoc sign by @saschagrunert in #3547
Attest the bundle, catalog and profiles at SLSA build level 3 by @saschagrunert in #3558

Bug

Fix node daemon bugs in the recorders, enrichers and profile controllers by @saschagrunert in #3546
Merge profiles recorded before 1.0 when their recording is deleted by @Vincent056 in #3552
Fix a race in the pod index lookup of pending containers by @saschagrunert in #3557
Fix recording AppArmor profiles with the bpf-recorder AppArmor profile by @saschagrunert in #3556
Fix bugs, races and drift across the operator, spoc and CI by @saschagrunert in #3560
Bump go-apparmor to v0.1.3 to fix loading profiles with AppArmor 5 parsers by @a1h8 in #3555
Attest SPDX 3 SBOMs with their predicate type and the operator version by @saschagrunert in #3562
Fix node daemon recording, metrics and seccomp edge cases by @saschagrunert in #3567
Fix ServiceMonitor targets, premature profile status, RBAC and recorder issues by @saschagrunert in #3575
Fix kernel version parsing and spoc privilege, pull and signing issues by @saschagrunert in #3574
Fix spoc run, signal, recording and signer pinning issues by @saschagrunert in #3581
Fix node daemon controller, BPF recorder and enricher issues by @saschagrunert in #3579
Fix daemon liveness on unsupported nodes and recorder, webhook and spoc bugs by @saschagrunert in #3586
Fix daemon recorder, enricher, profile deletion and spoc bugs by @saschagrunert in #3593
Fix webhook, SPOD, tracker and deployment issues by @saschagrunert in #3600
Fix SELinux daemon, recording merger, spoc and enricher issues by @saschagrunert in #3599
Fix recording webhook, trackers, SPOD and deployment issues by @saschagrunert in #3604
Fix daemon, spoc and SELinux denylist issues by @saschagrunert in #3606
Allow the daemon to open the directories it writes profiles to by @saschagrunert in #3610
Fix daemon, recorder, enricher and spoc issues by @saschagrunert in #3614
Fix binding and recording admission, conditions and deploy issues by @saschagrunert in #3618
Handle disabled kinds and unsupported nodes, fix recorder and spoc gaps by @saschagrunert in #3619
Fix control plane restarts, webhook, RBAC and lookups by @saschagrunert in #3624
Fix daemon, recorder and spoc issues by @saschagrunert in #3627

Cleanup

Update libbpf to v1.8.0 by @saschagrunert in #3543
Narrow operator RBAC and remove dead code, build and doc drift by @saschagrunert in #3584
Fix ineffective e2e checks, CI script gaps and deployment drift by @saschagrunert in #3594
Bump Go to 1.27.3 and install VirtualBox 7.2 in CI by @saschagrunert in #3607

New Contributors

@a1h8 made their first contribution in #3555

Full Changelog: v1.1.1...v1.1.2