From 91c07e04020f787bcf528e07193ffc3aa494583b Mon Sep 17 00:00:00 2001
From: Sascha Grunert <sgrunert@redhat.com>
Date: Tue, 30 Nov 2021 14:45:43 +0100
Subject: [PATCH] Add blog post about SPO v0.4.0 release

Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
---
 .../index.md                                  | 118 ++++++++++++++++++
 1 file changed, 118 insertions(+)
 create mode 100644 content/en/blog/_posts/2021-12-13-security-profiles-operator-v0.4.0/index.md

diff --git a/content/en/blog/_posts/2021-12-13-security-profiles-operator-v0.4.0/index.md b/content/en/blog/_posts/2021-12-13-security-profiles-operator-v0.4.0/index.md
new file mode 100644
index 0000000000..cb7a1d203c
--- /dev/null
+++ b/content/en/blog/_posts/2021-12-13-security-profiles-operator-v0.4.0/index.md
@@ -0,0 +1,118 @@
+---
+layout: blog
+title: "What's new in Security Profiles Operator v0.4.0"
+date: 2021-12-13
+slug: security-profiles-operator
+---
+
+**Authors:** Jakub Hrozek, Juan Antonio Osorio, Paulo Gomes, Sascha Grunert
+
+---
+
+The [Security Profiles Operator](https://sigs.k8s.io/security-profiles-operator)
+is an out-of-tree Kubernetes enhancement to make the management of
+[seccomp](https://en.wikipedia.org/wiki/Seccomp),
+[SELinux](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) and
+[AppArmor](https://en.wikipedia.org/wiki/AppArmor) profiles easier and more
+convenient. We're happy to announce that we recently [released
+v0.4.0](https://github.com/kubernetes-sigs/security-profiles-operator/releases/tag/v0.4.0)
+of the operator, which contains a ton of new features, fixes and usability
+improvements.
+
+## What's new
+
+<!--
+Current release notes as list of things to cover:
+
+## Changes by Kind
+
+### API Change
+
+- A v1alpha2 version of the SelinuxProfile object has been introduced. This
+  removes the raw CIL from the object itself and instead adds a simple policy
+  language to ease the writing and parsing experience.
+
+  Alongside, a RawSelinuxProfile object was also introduced. This contains a wrapped
+  and raw representation of the policy. This was intended for folks to be able to take
+  their existing policies into use as soon as possible. However, on validations are done here. (#675, @JAORMX)
+
+- Add CRD type to represent AppArmor profiles. (#643, @pjbgf)
+- Change seccomp profile type `Architectures` to `[]Arch` from `[]*Arch` (#671, @saschagrunert)
+- Graduate seccomp profile API from `v1alpha1` to `v1beta1` (#674, @saschagrunert)
+
+### Feature
+
+- Add arm64 support for retrieving the correct syscall names within the log enricher. (#539, @saschagrunert)
+- Add retry functionality to log enricher if container ID is still empty during pod creation. (#491, @saschagrunert)
+- Added CLI flag `-V` and environment variable parsing `SPO_VERBOSITY` to set the logging verbosity. (#657, @saschagrunert)
+- Added `metrics-token` secret to the operator namespace for metrics client retrieval. (#457, @saschagrunert)
+- Added `metrics` service endpoint to the operator namespace, which now serves the `security_profiles_operator_seccomp_profile` metric. (#422, @saschagrunert)
+- Added `seccomp_profile_error_total` metrics. (#461, @saschagrunert)
+- Added `verbosity` option to spod configuration. Currently supports `0` (the default) and `1` for enhanced verbosity. (#665, @saschagrunert)
+- Added automatic ServiceMonitor deployment if the CRD is available within the cluster. (#458, @saschagrunert)
+- Added container ID caching to log enricher for performance reasons. (#509, @saschagrunert)
+- Added libseccomp version output to `version` subcommand output. (#524, @saschagrunert)
+- Added liveness and startup probe to operator daemon set to streamline the operator stratup. (#430, @saschagrunert)
+- Added log enricher metrics `security_profiles_operator_seccomp_profile_audit_total` and `security_profiles_operator_selinux_profile_audit_total`. (#492, @saschagrunert)
+- Added logging to non-root-enabler (#486, @saschagrunert)
+- Added name=spod label to metrics service. (#456, @saschagrunert)
+- Added single TLS certificate for serving metrics. See `installation-usage.md` for more details. (#451, @saschagrunert)
+- Added support for recording profiles by using the log enricher. (#513, @saschagrunert)
+- Added syslog support for log enricher. (#531, @saschagrunert)
+- Added the seccomp profile architecture to the `bpf` and `log` recorder. (#670, @saschagrunert)
+- Automatically mount /dev/kmsg for log enricher usage if running with CRI-O and an allowed `io.kubernetes.cri-o.Devices` annotation. (#479, @saschagrunert)
+- Deploying kube-rbac-proxy sidecar in SPOD for exposing metrics via the new `metrics-spod` and `metrics-controller-runtime` services. (#424, @saschagrunert)
+- SPO's ProfileRecording CRD ProfileRecording which allows the admin to
+  record workloads and create security policies was extended to allow
+  recording SELinux profiles as well. In order to record a SELinux profile
+  for a workload, set ProfileRecording.Spec.Kind to SelinuxProfile. (#592, @jhrozek)
+- Switched to unix domain sockets for the GRPC servers. (#631, @saschagrunert)
+- This patch re-adds the no_bpf build tag triggered by the BPF_ENABLED=0 tag
+  environment variable if set to 0. A developer can then build SPO without the
+  built-in BPF support by running:
+  BPF_ENABLED=0 make
+  This is useful to build SPO in environments with older dependencies
+  that don't allow building the in-tree BPF-based recorder. (#690, @jhrozek)
+- Update example base profiles to their recent runtime versions. (#543, @saschagrunert)
+- `spod` can load and unload AppArmor profiles into clusters host servers.
+  `spod` now runs as `root` and `privileged` when apparmor is enabled. (#680, @pjbgf)
+
+### Documentation
+
+- Added documentation about how to record profiles by using the log enricher. (#521, @saschagrunert)
+- Added documentation how to use the automatically deployed `ServiceMonitor` with OpenShift as example platform. (#460, @saschagrunert)
+- Added log enricher documentation to installation-usage.md. (#498, @saschagrunert)
+- Added metrics documentation to `installation-usage.md`. (#449, @saschagrunert)
+- Added table of contents to installation documentation. (#493, @saschagrunert)
+- Changed documentation to reference `main` instead of `master` as default git branch. (#706, @saschagrunert)
+- Fixed header links containing source code in `installation-usage.md` (#606, @saschagrunert)
+
+### Bug or Regression
+
+- Do not retry container ID retrieval on container creation failures any more. (#612, @saschagrunert)
+
+### Other (Cleanup or Flake)
+
+- An OpenShift deployment manifest was included in deploy/openshift.yaml (#695, @JAORMX)
+- Bumps
+  golang.org/x/text to fix advisory GO-2021-0113 (#655, @pjbgf)
+- Log enricher now requires running auditd (`/var/log/audit/audit.log`) (#487, @saschagrunert)
+- Log libseccomp version on operator startup. (#556, @saschagrunert)
+- Removed CPU limits from SPOD and added resource requests/limits to manager and webhook. (#550, @saschagrunert)
+- The directory /etc/selinux.d used to be mounted on the hosts in previous SPO versions.
+  This is no longer the case, the directory was converted to an emptyDir instead,
+  reducing the number of required host mounts. (#698, @jhrozek)
+- The securityprofilenodestatus CR now links with the security profile its status
+  it represents using label spo.x-k8s.io/profile-id. If the profile name is less
+  than 64 characters long, then the label value is the profile name, otherwise it's
+  kind-sha1hashofthename.
+
+  This change supports profile names whose names are over 64 characters. (#685, @jhrozek)
+
+- Update cert-manager to v1.5.3 (#577, @saschagrunert)
+
+### Uncategorized
+
+- Add Metrics for SELinux profiles (#470, @mrogers950)
+- Added new seccomp profile recorder `bpf`. (#618, @saschagrunert)
+-->