Kubernetes Security Profiles Operator

The Security Profiles Operator (SPO) is an out-of-tree Kubernetes enhancement which aims to make it easier to create and use SELinux, seccomp and AppArmor security profiles in Kubernetes clusters.

The documentation covers the installation, the profiles, the spoc command line interface, troubleshooting and the development of SPO. The released container images are available below registry.k8s.io/security-profiles-operator, see verifying the released artifacts.

Quick start

Install cert-manager, which is not needed on OpenShift:

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.yaml
kubectl --namespace cert-manager wait --for condition=available deployment --all

Install the operator from the manifest of the latest release, where VERSION is its version without the v prefix:

VERSION=x.y.z
kubectl apply -f "https://raw.githubusercontent.com/kubernetes-sigs/security-profiles-operator/v${VERSION}/deploy/operator.yaml"

Once kubectl -n security-profiles-operator get spod spod reports the state Running, create the example seccomp profiles and check that they got installed on the nodes:

$ kubectl apply -f "https://raw.githubusercontent.com/kubernetes-sigs/security-profiles-operator/v${VERSION}/examples/seccompprofile.yaml"
$ kubectl get sp
NAME                               STATUS      AGE
profile-allow-unsafe               Installed   20s
profile-block-all                  Installed   20s
profile-complain-block-high-risk   Installed   20s
profile-complain-unsafe            Installed   20s

Use Seccomp profile shows how a pod uses them.

Installation methods

• Release manifest, as in the quick start above.
• Helm chart, attached to each release and published on registry.k8s.io.
• OLM, from operatorhub.io or from the upstream catalog.
• OpenShift, through OperatorHub. OpenShift needs no cert-manager.

Features

This is the parity of features across various security profiles supported by the SPO:

For information about the security model and what permissions each feature requires, refer to SPO's security model.

Resources

The motivation behind the project can be found in the corresponding RFC.

The operator runs as a deployment in the cluster and manages daemon pods on each node. These daemon pods handle profile installation, recording, and enforcement for seccomp, SELinux, and AppArmor. The documentation describes the architecture and links the user stories, personas and guides.

Related Kubernetes Enhancement Proposals (KEPs) which have direct influence on this project:

• Promote seccomp to GA
• Add ConfigMap support for seccomp custom profiles
• Add KEP to create seccomp built-in profiles and add complain mode

Next to those KEPs, here are existing approaches for security profiles in the Kubernetes world:

• AppArmor Loader
• OpenShift's Machine config operator, in charge of file management and security profiles on hosts
• seccomp-config

Community, discussions, contributions, and support

If you're interested in contributing to SPO, please see the developer focused document.

We schedule a monthly meeting every last Thursday of a month.

• Meeting Notes

Learn how to engage with the Kubernetes community on the community page.

You can reach the maintainers of this project at:

• Slack #security-profiles-operator
• Mailing List

Code of conduct

Participation in the Kubernetes community is governed by the Kubernetes Code of Conduct.