The Security Profiles Operator (SPO) is an out-of-tree Kubernetes enhancement which aims to make it easier to create and use SELinux, seccomp and AppArmor security profiles in Kubernetes clusters.
The documentation covers the installation, the profiles, the
spoc command line interface, troubleshooting and the development of SPO. The
released container images are available below
registry.k8s.io/security-profiles-operator, see
verifying the released artifacts.
Install cert-manager, which is not needed on OpenShift:
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.yaml
kubectl --namespace cert-manager wait --for condition=available deployment --allInstall the operator from the manifest of the
latest release,
where VERSION is its version without the v prefix:
VERSION=x.y.z
kubectl apply -f "https://raw.githubusercontent.com/kubernetes-sigs/security-profiles-operator/v${VERSION}/deploy/operator.yaml"Once kubectl -n security-profiles-operator get spod spod reports the state
Running, create the example seccomp profiles and check that they got
installed on the nodes:
$ kubectl apply -f "https://raw.githubusercontent.com/kubernetes-sigs/security-profiles-operator/v${VERSION}/examples/seccompprofile.yaml"
$ kubectl get sp
NAME STATUS AGE
profile-allow-unsafe Installed 20s
profile-block-all Installed 20s
profile-complain-block-high-risk Installed 20s
profile-complain-unsafe Installed 20sUse Seccomp profile shows how a pod uses them.
- Release manifest, as in the quick start above.
- Helm chart, attached to each
release and published on
registry.k8s.io. - OLM, from operatorhub.io or from the upstream catalog.
- OpenShift, through OperatorHub. OpenShift needs no cert-manager.
This is the parity of features across various security profiles supported by the SPO:
| Seccomp | SELinux | AppArmor | |
|---|---|---|---|
| Profile CRD | Yes | Yes | Yes |
| Install profiles in cluster | Yes | Yes | Yes |
| Remove unused profiles from cluster | Yes | Yes | Yes |
| Profile Recording (audit logs) | Yes | Yes | No |
| Profile Recording (eBPF) | Yes | No | Yes |
| Profile Binding to container images | Yes | Yes | Yes |
| Audit log enrichment | Yes | Yes | Yes |
| Audit In-Pod Activity JSON log enrichment | Yes | No | No |
For information about the security model and what permissions each feature requires, refer to SPO's security model.
The motivation behind the project can be found in the corresponding RFC.
The operator runs as a deployment in the cluster and manages daemon pods on each node. These daemon pods handle profile installation, recording, and enforcement for seccomp, SELinux, and AppArmor. The documentation describes the architecture and links the user stories, personas and guides.
Related Kubernetes Enhancement Proposals (KEPs) which have direct influence on this project:
- Promote seccomp to GA
- Add ConfigMap support for seccomp custom profiles
- Add KEP to create seccomp built-in profiles and add complain mode
Next to those KEPs, here are existing approaches for security profiles in the Kubernetes world:
- AppArmor Loader
- OpenShift's Machine config operator, in charge of file management and security profiles on hosts
- seccomp-config
If you're interested in contributing to SPO, please see the developer focused document.
We schedule a monthly meeting every last Thursday of a month.
Learn how to engage with the Kubernetes community on the community page.
You can reach the maintainers of this project at:
Participation in the Kubernetes community is governed by the Kubernetes Code of Conduct.