Skip to content

v0.4.3
Compare
Choose a tag to compare
@saschagrunert saschagrunert released this 07 Jun 12:11
· 1757 commits to main since this release
v0.4.3
b199097

Release notes

Welcome to our glorious next release of the security-profiles-operator! We hope you enjoy this release as much as we do! The general usage and setup can be found in our documentation. 🥳 👯

To install the operator, run:

$ kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/security-profiles-operator/v0.4.3/deploy/operator.yaml

Feel free to provide us any kind of feedback in the official Kubernetes Slack #security-profiles-operator channel.

Changes by Kind

API Change

  • Added the ability to tag pods that present denials from either Seccomp or SELinux. This will happen through the 'spo.x-k8s.io/had-denials' label. (#846, @JAORMX)

Feature

  • Added the ability to use SelinuxProfile when creating profilebinding objects. (#854, @Vincent056)
  • The security_profiles_operator_selinux_profile_audit_total metric was actually enabled and uses the appropriate labels scraped from the audit.log file. (#916, @jhrozek)
  • The spod CR gains a new field webhookOptions which allows the webhooks' failurePolicy and namespaceSelector to be configurable. (#883, @jhrozek)
  • Added a syscall allow list in the SPOD configuration (#913, @ccojocar)
  • Make allowed seccomp actions configurable in the SPOD configuration. (#927, @ccojocar)
  • Make the tolerations of the webhook configurable via the SPOD configuration (#892, @ccojocar)

Documentation

  • It is now possible to install SPO from packages provided on operatorhub.io. User-facing documentation is provided in the installation-usage.md document. (#889, @jhrozek)

Bug or Regression

  • The security-profiles-operator namespace is now labeled with the following labels:
    pod-security.kubernetes.io/enforce: privileged
    pod-security.kubernetes.io/audit: privileged
    pod-security.kubernetes.io/warn: privileged
    To account for clusters that are enabling PSA and defaulting to the restricted one.

    When using another namespace or creating the namespace with other means,
    please ensure that the namespace has the above labels. (#944, @jhrozek)

Other (Cleanup or Flake)

Dependencies

Added

  • github.com/AdaLogics/go-fuzz-headers: 6c3934b
  • github.com/ahmetb/gen-crd-api-reference-docs: v0.3.0
  • github.com/andybalholm/brotli: v1.0.1
  • github.com/cert-manager/cert-manager: v1.8.0
  • github.com/dsnet/compress: f669936
  • github.com/go-logr/stdr: v1.2.2
  • github.com/golang-jwt/jwt/v4: v4.0.0
  • github.com/google/gnostic: v0.5.7-v3refs
  • github.com/googleapis/google-cloud-go-testing: bcd43fb
  • github.com/hashicorp/go-plugin: v1.4.3
  • github.com/hashicorp/go-secure-stdlib/mlock: v0.1.1
  • github.com/hashicorp/go-secure-stdlib/parseutil: v0.1.1
  • github.com/hashicorp/go-secure-stdlib/strutil: v0.1.1
  • github.com/hashicorp/yamux: 3520598
  • github.com/intel/goresctrl: v0.2.0
  • github.com/lithammer/dedent: v1.1.0
  • github.com/mholt/archiver/v3: v3.5.1
  • github.com/moby/sys/signal: v0.6.0
  • github.com/mogensen/kubernetes-split-yaml: v0.3.0
  • github.com/networkplumbing/go-nft: v0.2.0
  • github.com/nwaples/rardecode: v1.1.0
  • github.com/oklog/run: v1.0.0
  • github.com/pierrec/lz4/v4: v4.1.2
  • github.com/segmentio/asm: v1.1.3
  • github.com/segmentio/encoding: v0.3.3
  • github.com/xi2/xz: 48954b6
  • github.com/xrash/smetrics: 039620a
  • go.opentelemetry.io/otel/exporters/otlp/internal/retry: v1.3.0
  • go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc: v1.3.0
  • go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp: v1.3.0
  • go.opentelemetry.io/otel/exporters/otlp/otlptrace: v1.3.0

Changed

Removed

  • github.com/DataDog/datadog-go: v3.2.0+incompatible
  • github.com/Nvveen/Gotty: cd52737
  • github.com/cheggaaa/pb: v1.0.27
  • github.com/circonus-labs/circonus-gometrics: v2.3.1+incompatible
  • github.com/circonus-labs/circonusllhist: v0.1.3
  • github.com/coreos/go-etcd: v2.0.0+incompatible
  • github.com/cpuguy83/go-md2man: v1.0.10
  • github.com/globalsign/mgo: eeefdec
  • github.com/go-openapi/analysis: v0.19.2
  • github.com/go-openapi/errors: v0.19.2
  • github.com/go-openapi/loads: v0.19.2
  • github.com/go-openapi/runtime: v0.19.0
  • github.com/go-openapi/strfmt: v0.19.0
  • github.com/go-openapi/validate: v0.19.2
  • github.com/gophercloud/gophercloud: v0.1.0
  • github.com/gotestyourself/gotestyourself: v2.2.0+incompatible
  • github.com/iancoleman/strcase: v0.2.0
  • github.com/jetstack/cert-manager: v1.7.2
  • github.com/lyft/protoc-gen-star: v0.5.3
  • github.com/pborman/uuid: v1.2.0
  • github.com/remyoudompheng/bigfft: 52369c6
  • github.com/sagikazarmark/crypt: v0.3.0
  • github.com/sylabs/release-tools: v0.1.0
  • github.com/ugorji/go/codec: d75b2dc
  • gonum.org/v1/gonum: 3d26580
  • gonum.org/v1/netlib: 7672324
  • modernc.org/cc: v1.0.0
  • modernc.org/golex: v1.0.0
  • modernc.org/mathutil: v1.0.0
  • modernc.org/strutil: v1.0.0
  • modernc.org/xc: v1.0.0
  • sigs.k8s.io/structured-merge-diff: 6149e45

Contributors

JAORMX, ccojocar, and 3 other contributors
Assets 2
Loading