Add blog post about SPO v0.4.0 release
Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
This commit is contained in:
Sascha Grunert
@@ -0,0 +1,118 @@
|
||||
---
|
||||
layout: blog
|
||||
title: "What's new in Security Profiles Operator v0.4.0"
|
||||
date: 2021-12-13
|
||||
slug: security-profiles-operator
|
||||
---
|
||||
|
||||
**Authors:** Jakub Hrozek, Juan Antonio Osorio, Paulo Gomes, Sascha Grunert
|
||||
|
||||
---
|
||||
|
||||
The [Security Profiles Operator](https://sigs.k8s.io/security-profiles-operator)
|
||||
is an out-of-tree Kubernetes enhancement to make the management of
|
||||
[seccomp](https://en.wikipedia.org/wiki/Seccomp),
|
||||
[SELinux](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) and
|
||||
[AppArmor](https://en.wikipedia.org/wiki/AppArmor) profiles easier and more
|
||||
convenient. We're happy to announce that we recently [released
|
||||
v0.4.0](https://github.com/kubernetes-sigs/security-profiles-operator/releases/tag/v0.4.0)
|
||||
of the operator, which contains a ton of new features, fixes and usability
|
||||
improvements.
|
||||
|
||||
## What's new
|
||||
|
||||
<!--
|
||||
Current release notes as list of things to cover:
|
||||
|
||||
## Changes by Kind
|
||||
|
||||
### API Change
|
||||
|
||||
- A v1alpha2 version of the SelinuxProfile object has been introduced. This
|
||||
removes the raw CIL from the object itself and instead adds a simple policy
|
||||
language to ease the writing and parsing experience.
|
||||
|
||||
Alongside, a RawSelinuxProfile object was also introduced. This contains a wrapped
|
||||
and raw representation of the policy. This was intended for folks to be able to take
|
||||
their existing policies into use as soon as possible. However, on validations are done here. (#675, @JAORMX)
|
||||
|
||||
- Add CRD type to represent AppArmor profiles. (#643, @pjbgf)
|
||||
- Change seccomp profile type `Architectures` to `[]Arch` from `[]*Arch` (#671, @saschagrunert)
|
||||
- Graduate seccomp profile API from `v1alpha1` to `v1beta1` (#674, @saschagrunert)
|
||||
|
||||
### Feature
|
||||
|
||||
- Add arm64 support for retrieving the correct syscall names within the log enricher. (#539, @saschagrunert)
|
||||
- Add retry functionality to log enricher if container ID is still empty during pod creation. (#491, @saschagrunert)
|
||||
- Added CLI flag `-V` and environment variable parsing `SPO_VERBOSITY` to set the logging verbosity. (#657, @saschagrunert)
|
||||
- Added `metrics-token` secret to the operator namespace for metrics client retrieval. (#457, @saschagrunert)
|
||||
- Added `metrics` service endpoint to the operator namespace, which now serves the `security_profiles_operator_seccomp_profile` metric. (#422, @saschagrunert)
|
||||
- Added `seccomp_profile_error_total` metrics. (#461, @saschagrunert)
|
||||
- Added `verbosity` option to spod configuration. Currently supports `0` (the default) and `1` for enhanced verbosity. (#665, @saschagrunert)
|
||||
- Added automatic ServiceMonitor deployment if the CRD is available within the cluster. (#458, @saschagrunert)
|
||||
- Added container ID caching to log enricher for performance reasons. (#509, @saschagrunert)
|
||||
- Added libseccomp version output to `version` subcommand output. (#524, @saschagrunert)
|
||||
- Added liveness and startup probe to operator daemon set to streamline the operator stratup. (#430, @saschagrunert)
|
||||
- Added log enricher metrics `security_profiles_operator_seccomp_profile_audit_total` and `security_profiles_operator_selinux_profile_audit_total`. (#492, @saschagrunert)
|
||||
- Added logging to non-root-enabler (#486, @saschagrunert)
|
||||
- Added name=spod label to metrics service. (#456, @saschagrunert)
|
||||
- Added single TLS certificate for serving metrics. See `installation-usage.md` for more details. (#451, @saschagrunert)
|
||||
- Added support for recording profiles by using the log enricher. (#513, @saschagrunert)
|
||||
- Added syslog support for log enricher. (#531, @saschagrunert)
|
||||
- Added the seccomp profile architecture to the `bpf` and `log` recorder. (#670, @saschagrunert)
|
||||
- Automatically mount /dev/kmsg for log enricher usage if running with CRI-O and an allowed `io.kubernetes.cri-o.Devices` annotation. (#479, @saschagrunert)
|
||||
- Deploying kube-rbac-proxy sidecar in SPOD for exposing metrics via the new `metrics-spod` and `metrics-controller-runtime` services. (#424, @saschagrunert)
|
||||
- SPO's ProfileRecording CRD ProfileRecording which allows the admin to
|
||||
record workloads and create security policies was extended to allow
|
||||
recording SELinux profiles as well. In order to record a SELinux profile
|
||||
for a workload, set ProfileRecording.Spec.Kind to SelinuxProfile. (#592, @jhrozek)
|
||||
- Switched to unix domain sockets for the GRPC servers. (#631, @saschagrunert)
|
||||
- This patch re-adds the no_bpf build tag triggered by the BPF_ENABLED=0 tag
|
||||
environment variable if set to 0. A developer can then build SPO without the
|
||||
built-in BPF support by running:
|
||||
BPF_ENABLED=0 make
|
||||
This is useful to build SPO in environments with older dependencies
|
||||
that don't allow building the in-tree BPF-based recorder. (#690, @jhrozek)
|
||||
- Update example base profiles to their recent runtime versions. (#543, @saschagrunert)
|
||||
- `spod` can load and unload AppArmor profiles into clusters host servers.
|
||||
`spod` now runs as `root` and `privileged` when apparmor is enabled. (#680, @pjbgf)
|
||||
|
||||
### Documentation
|
||||
|
||||
- Added documentation about how to record profiles by using the log enricher. (#521, @saschagrunert)
|
||||
- Added documentation how to use the automatically deployed `ServiceMonitor` with OpenShift as example platform. (#460, @saschagrunert)
|
||||
- Added log enricher documentation to installation-usage.md. (#498, @saschagrunert)
|
||||
- Added metrics documentation to `installation-usage.md`. (#449, @saschagrunert)
|
||||
- Added table of contents to installation documentation. (#493, @saschagrunert)
|
||||
- Changed documentation to reference `main` instead of `master` as default git branch. (#706, @saschagrunert)
|
||||
- Fixed header links containing source code in `installation-usage.md` (#606, @saschagrunert)
|
||||
|
||||
### Bug or Regression
|
||||
|
||||
- Do not retry container ID retrieval on container creation failures any more. (#612, @saschagrunert)
|
||||
|
||||
### Other (Cleanup or Flake)
|
||||
|
||||
- An OpenShift deployment manifest was included in deploy/openshift.yaml (#695, @JAORMX)
|
||||
- Bumps
|
||||
golang.org/x/text to fix advisory GO-2021-0113 (#655, @pjbgf)
|
||||
- Log enricher now requires running auditd (`/var/log/audit/audit.log`) (#487, @saschagrunert)
|
||||
- Log libseccomp version on operator startup. (#556, @saschagrunert)
|
||||
- Removed CPU limits from SPOD and added resource requests/limits to manager and webhook. (#550, @saschagrunert)
|
||||
- The directory /etc/selinux.d used to be mounted on the hosts in previous SPO versions.
|
||||
This is no longer the case, the directory was converted to an emptyDir instead,
|
||||
reducing the number of required host mounts. (#698, @jhrozek)
|
||||
- The securityprofilenodestatus CR now links with the security profile its status
|
||||
it represents using label spo.x-k8s.io/profile-id. If the profile name is less
|
||||
than 64 characters long, then the label value is the profile name, otherwise it's
|
||||
kind-sha1hashofthename.
|
||||
|
||||
This change supports profile names whose names are over 64 characters. (#685, @jhrozek)
|
||||
|
||||
- Update cert-manager to v1.5.3 (#577, @saschagrunert)
|
||||
|
||||
### Uncategorized
|
||||
|
||||
- Add Metrics for SELinux profiles (#470, @mrogers950)
|
||||
- Added new seccomp profile recorder `bpf`. (#618, @saschagrunert)
|
||||
-->
|
||||
Reference in New Issue
Block a user