Add spoc, the Security Profiles Operator CLI

[saschagrunert]

What type of PR is this?

/kind feature

What this PR does / why we need it:

We discussed in our last sync meeting that it would be helpful to have a slimmer SPO CLI for faster execution in edge scenarios. For that we would need a new binary, which can be used to directly interact with features like the ebpf recorder.

Which issue(s) this PR fixes:

Refers to #1482

Does this PR have test?

None

Special notes for your reviewer:

None

Does this PR introduce a user-facing change?

Added `spoc` binary, the Security Profiles Operator CLI. This new binary is also part of the default container images.

[saschagrunert]

@kubernetes-sigs/security-profiles-operator-maintainers PTAL

[JAORMX]

I love the name!!

[JAORMX]

/lgtm cancel
Let's let other maintainers look at this first

[ccojocar]

lgtm

How do you envision the workflow of using the CLI? Does one need to run the spoc container on the same host next to another container for which the recording is performed? Is additionally required the existing recorder container which communicates over gRCP with spoc container, or does it get merged into spoc CLI container?

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ccojocar, JAORMX, saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [JAORMX,saschagrunert]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[saschagrunert]

How do you envision the workflow of using the CLI? Does one need to run the spoc container on the same host next to another container for which the recording is performed?

No, my main idea was to provide 2 distinct sets of functionality:

• Doing something without having a need for kubernetes at all, means that there is also no operator deployed
• Having sort of client interface to the operator

Means we can start with the first one and trying to integrate bpf recording of executables. Later on we can use the same binary for other features.