Bump v0.10.0

ngopalak-redhat · k8s-ci-robot · commit 3f8de1eb6392 · 2025-08-20T04:41:04.000-07:00
diff --git a/VERSION b/VERSION
@@ -1 +1 @@
-0.9.2-dev
+0.10.0
diff --git a/bundle.Dockerfile b/bundle.Dockerfile
@@ -5,8 +5,8 @@ LABEL operators.operatorframework.io.bundle.mediatype.v1=registry+v1
 LABEL operators.operatorframework.io.bundle.manifests.v1=manifests/
 LABEL operators.operatorframework.io.bundle.metadata.v1=metadata/
 LABEL operators.operatorframework.io.bundle.package.v1=security-profiles-operator
-LABEL operators.operatorframework.io.bundle.channels.v1=beta
-LABEL operators.operatorframework.io.bundle.channel.default.v1=beta
+LABEL operators.operatorframework.io.bundle.channels.v1=stable
+LABEL operators.operatorframework.io.bundle.channel.default.v1=stable
 LABEL operators.operatorframework.io.metrics.builder=operator-sdk-v1.37.0
 LABEL operators.operatorframework.io.metrics.mediatype.v1=metrics+v1
 LABEL operators.operatorframework.io.metrics.project_layout=go.kubebuilder.io/v4
diff --git a/bundle/manifests/security-profiles-operator-profile_v1_configmap.yaml b/bundle/manifests/security-profiles-operator-profile_v1_configmap.yaml
@@ -1,11 +1,5 @@
 apiVersion: v1
 data:
-  json-enricher-log-volume-source.json: |
-    {
-      "emptyDir": {
-        "sizeLimit": "500Mi"
-      }
-    }
   bpf-recorder.json: |
     {
       "defaultAction": "SCMP_ACT_ERRNO",
@@ -160,6 +154,13 @@ data:
             allowTcp: true
             allowUdp: true
       disabled: false
+  json-enricher-log-volume-mount-path: /data/logs/jsonenricher
+  json-enricher-log-volume-source.json: |-
+    {
+      "emptyDir": {
+        "sizeLimit": "500Mi"
+      }
+    }
   security-profiles-operator.json: |
     {
       "defaultAction": "SCMP_ACT_ERRNO",
@@ -275,11 +276,7 @@ data:
             "imageFromVar":"RELATED_IMAGE_SELINUXD_EL8"
         },
         {
-            "regex":"(.*)(CoreOS).*([\\d+])\\.9[\\d+]\\.(.*)",
-            "imageFromVar":"RELATED_IMAGE_SELINUXD_EL9"
-        },
-        {
-            "regex":"(.*)(CoreOS)([\\s+])9\\.(.*)",
+            "regex":"(.*)(CoreOS).*([\\d+])\\.9[\\d+]\\.(.*)|(.*)(CoreOS)([\\s+])9\\.(.*)",
             "imageFromVar":"RELATED_IMAGE_SELINUXD_EL9"
         },
         {
diff --git a/bundle/manifests/security-profiles-operator.clusterserviceversion.yaml b/bundle/manifests/security-profiles-operator.clusterserviceversion.yaml
@@ -247,17 +247,17 @@ metadata:
       ]
     capabilities: Basic Install
     categories: Security
-    containerImage: registry.k8s.io/security-profiles-operator/security-profiles-operator:v0.9.1
-    createdAt: "2025-04-09T08:07:05Z"
-    olm.skipRange: '>=0.4.1 <0.9.2-dev'
+    containerImage: registry.k8s.io/security-profiles-operator/security-profiles-operator:v0.10.0
+    createdAt: "2025-08-13T11:56:07Z"
+    olm.skipRange: '>=0.4.1 <0.10.0'
     operatorframework.io/cluster-monitoring: "true"
     operatorframework.io/os.linux: supported
     operatorframework.io/suggested-namespace: security-profiles-operator
     operators.openshift.io/valid-subscription: '["OpenShift Kubernetes Engine", "OpenShift
       Container Platform", "OpenShift Platform Plus"]'
     operators.operatorframework.io/builder: operator-sdk-v1.37.0
     operators.operatorframework.io/project_layout: go.kubebuilder.io/v4
-  name: security-profiles-operator.v0.9.2-dev
+  name: security-profiles-operator.v0.10.0
   namespace: placeholder
 spec:
   apiservicedefinitions: {}
@@ -698,7 +698,7 @@ spec:
                       fieldPath: spec.nodeName
                 - name: KUBELET_DIR
                   value: /var/lib/kubelet
-                image: gcr.io/k8s-staging-sp-operator/security-profiles-operator:latest
+                image: registry.k8s.io/security-profiles-operator/security-profiles-operator:v0.10.0
                 imagePullPolicy: Always
                 name: security-profiles-operator
                 resources:
@@ -809,5 +809,5 @@ spec:
     name: selinuxd-el9
   - image: quay.io/security-profiles-operator/selinuxd-fedora:latest
     name: selinuxd-fedora
-  replaces: security-profiles-operator.v0.8.4
-  version: 0.9.2-dev
+  replaces: security-profiles-operator.v0.9.1
+  version: 0.10.0
diff --git a/bundle/manifests/security-profiles-operator.x-k8s.io_apparmorprofiles.yaml b/bundle/manifests/security-profiles-operator.x-k8s.io_apparmorprofiles.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
diff --git a/bundle/manifests/security-profiles-operator.x-k8s.io_profilebindings.yaml b/bundle/manifests/security-profiles-operator.x-k8s.io_profilebindings.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
diff --git a/bundle/manifests/security-profiles-operator.x-k8s.io_profilerecordings.yaml b/bundle/manifests/security-profiles-operator.x-k8s.io_profilerecordings.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
diff --git a/bundle/manifests/security-profiles-operator.x-k8s.io_rawselinuxprofiles.yaml b/bundle/manifests/security-profiles-operator.x-k8s.io_rawselinuxprofiles.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
diff --git a/bundle/manifests/security-profiles-operator.x-k8s.io_seccompprofiles.yaml b/bundle/manifests/security-profiles-operator.x-k8s.io_seccompprofiles.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
diff --git a/bundle/manifests/security-profiles-operator.x-k8s.io_securityprofilenodestatuses.yaml b/bundle/manifests/security-profiles-operator.x-k8s.io_securityprofilenodestatuses.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
diff --git a/bundle/manifests/security-profiles-operator.x-k8s.io_securityprofilesoperatordaemons.yaml b/bundle/manifests/security-profiles-operator.x-k8s.io_securityprofilesoperatordaemons.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
@@ -332,7 +332,6 @@ spec:
                                     pod labels will be ignored. The default value is empty.
                                     The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                     Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                    This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                   items:
                                     type: string
                                   type: array
@@ -347,7 +346,6 @@ spec:
                                     pod labels will be ignored. The default value is empty.
                                     The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                     Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                    This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                   items:
                                     type: string
                                   type: array
@@ -513,7 +511,6 @@ spec:
                                 pod labels will be ignored. The default value is empty.
                                 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                 Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                               items:
                                 type: string
                               type: array
@@ -528,7 +525,6 @@ spec:
                                 pod labels will be ignored. The default value is empty.
                                 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                               items:
                                 type: string
                               type: array
@@ -691,7 +687,6 @@ spec:
                                     pod labels will be ignored. The default value is empty.
                                     The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                     Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                    This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                   items:
                                     type: string
                                   type: array
@@ -706,7 +701,6 @@ spec:
                                     pod labels will be ignored. The default value is empty.
                                     The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                     Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                    This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                                   items:
                                     type: string
                                   type: array
@@ -872,7 +866,6 @@ spec:
                                 pod labels will be ignored. The default value is empty.
                                 The same key is forbidden to exist in both matchLabelKeys and labelSelector.
                                 Also, matchLabelKeys cannot be set when labelSelector isn't set.
-                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                               items:
                                 type: string
                               type: array
@@ -887,7 +880,6 @@ spec:
                                 pod labels will be ignored. The default value is empty.
                                 The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
                                 Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-                                This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
                               items:
                                 type: string
                               type: array
@@ -1058,6 +1050,11 @@ spec:
                   tells the operator whether or not to enable bpf recorder support for this
                   SPOD instance.
                 type: boolean
+              enableJsonEnricher:
+                description: |-
+                  tells the operator whether or not to enable audit JSON enrichment support for this
+                  SPOD instance.
+                type: boolean
               enableLogEnricher:
                 description: |-
                   tells the operator whether or not to enable log enrichment support for this
@@ -1108,6 +1105,58 @@ spec:
                   type: object
                   x-kubernetes-map-type: atomic
                 type: array
+              jsonEnricherFilters:
+                default: ""
+                description: |-
+                  JsonEnricherFilters if defined, an optional JSON-format filter to determine if log lines should be emitted
+                  for the json-enricher. Defaults to an empty string, meaning no filter is applied and all lines are logged.
+                type: string
+              jsonEnricherOptions:
+                description: |-
+                  Defines options specific to the JsonEnricher
+                  functionality of the SecurityProfilesOperator
+                  Its optional to provide this configuration
+                properties:
+                  auditLogIntervalSeconds:
+                    description: |-
+                      Specifies the interval, in seconds, at which the accumulated audit log
+                      data is output in JSON format. For each process, syscalls occurring
+                      within this interval are grouped together. The default is 60 seconds.
+                      Increasing this interval will reduce the rate at which logs are written.
+                    format: int32
+                    type: integer
+                  auditLogMaxAge:
+                    description: |-
+                      This field specifies the maximum number of days to retain old audit log files
+                      The default is not to remove old log files based on age
+                    format: int32
+                    type: integer
+                  auditLogMaxBackups:
+                    description: |-
+                      This field specifies the maximum size in megabytes of the audit log file before it gets rotated.
+                      The default is to retain all old log files (though MaxAge may still cause them to get deleted.)
+                    format: int32
+                    type: integer
+                  auditLogMaxSize:
+                    description: |-
+                      This field specifies the maximum number of audit log files to retain.
+                      If left unspecified it defaults to 100 MB.
+                    format: int32
+                    type: integer
+                  auditLogPath:
+                    description: |-
+                      This field specifies the path for the accumulated audit log data.
+                      The audit log will be written to this file in JSON format if a file path
+                      is provided. If left unspecified, the output will be directed to
+                      standard output (stdout).
+                    type: string
+                type: object
+              logEnricherFilters:
+                default: ""
+                description: |-
+                  LogEnricherFilters if defined, an optional JSON-format filter to determine if log lines should be emitted
+                  for the log-enricher. Defaults to an empty string, meaning no filter is applied and all lines are logged.
+                type: string
               logEnricherSource:
                 description: |-
                   logEnricherSource determines which source should be used for audit logs.
diff --git a/bundle/manifests/security-profiles-operator.x-k8s.io_selinuxprofiles.yaml b/bundle/manifests/security-profiles-operator.x-k8s.io_selinuxprofiles.yaml
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.18.0
   creationTimestamp: null
   labels:
     app: security-profiles-operator
diff --git a/bundle/metadata/annotations.yaml b/bundle/metadata/annotations.yaml
@@ -4,8 +4,8 @@ annotations:
   operators.operatorframework.io.bundle.manifests.v1: manifests/
   operators.operatorframework.io.bundle.metadata.v1: metadata/
   operators.operatorframework.io.bundle.package.v1: security-profiles-operator
-  operators.operatorframework.io.bundle.channels.v1: beta
-  operators.operatorframework.io.bundle.channel.default.v1: beta
+  operators.operatorframework.io.bundle.channels.v1: stable
+  operators.operatorframework.io.bundle.channel.default.v1: stable
   operators.operatorframework.io.metrics.builder: operator-sdk-v1.37.0
   operators.operatorframework.io.metrics.mediatype.v1: metrics+v1
   operators.operatorframework.io.metrics.project_layout: go.kubebuilder.io/v4
diff --git a/dependencies.yaml b/dependencies.yaml
@@ -162,7 +162,7 @@ dependencies:
       match: BOM_VERSION
 
   - name: spo-current
-    version: 0.9.2-dev
+    version: 0.10.0
     refPaths:
     - path: VERSION
       match: ^.*
diff --git a/deploy/base/clusterserviceversion.yaml b/deploy/base/clusterserviceversion.yaml
@@ -6,7 +6,7 @@ metadata:
     alm-examples: '[]'
     capabilities: Basic Install
     categories: Security
-    containerImage: registry.k8s.io/security-profiles-operator/security-profiles-operator:v0.9.1
+    containerImage: registry.k8s.io/security-profiles-operator/security-profiles-operator:v0.10.0
     olm.skipRange: '>=0.4.1 <0.8.5-dev'
     operatorframework.io/suggested-namespace: security-profiles-operator
     operators.openshift.io/valid-subscription: '["OpenShift Kubernetes Engine", "OpenShift Container Platform", "OpenShift Platform Plus"]'
@@ -90,5 +90,5 @@ spec:
   provider:
     name: Kubernetes SIGs
     url: https://github.com/kubernetes-sigs
-  replaces: security-profiles-operator.v0.8.4
+  replaces: security-profiles-operator.v0.9.1
   version: 0.0.0
diff --git a/deploy/catalog-preamble.json b/deploy/catalog-preamble.json
@@ -13,8 +13,8 @@
     "package": "security-profiles-operator",
     "entries": [
         {
-            "name": "security-profiles-operator.v0.9.2-dev",
-            "skipRange": ">=0.4.1 <0.9.2-dev"
+            "name": "security-profiles-operator.v0.10.0",
+            "skipRange": ">=0.4.1 <0.10.0"
         }
     ]
 }
diff --git a/deploy/helm/Chart.yaml b/deploy/helm/Chart.yaml
@@ -2,5 +2,5 @@ apiVersion: v2
 name: security-profiles-operator
 description: "The Kubernetes Security Profiles Operator."
 type: application
-version: "0.9.2-dev"
-appVersion: "0.9.2-dev"
+version: "0.10.0"
+appVersion: "0.10.0"
diff --git a/deploy/kustomize-deployment/kustomization.yaml b/deploy/kustomize-deployment/kustomization.yaml
@@ -6,11 +6,11 @@ sortOptions:
 
 images:
 - name: security-profiles-operator
-  newName: gcr.io/k8s-staging-sp-operator/security-profiles-operator
-  newTag: latest
+  # # # newName: gcr.io/k8s-staging-sp-operator/security-profiles-operator
+  # # # newTag: latest
   # For images to be released:
-  # newName: registry.k8s.io/security-profiles-operator/security-profiles-operator
-  # newTag: v0.9.2
+  newName: registry.k8s.io/security-profiles-operator/security-profiles-operator
+  newTag: v0.10.0
 
 
 resources:
diff --git a/deploy/namespace-operator.yaml b/deploy/namespace-operator.yaml
@@ -3459,7 +3459,7 @@ spec:
               fieldPath: spec.nodeName
         - name: KUBELET_DIR
           value: /var/lib/kubelet
-        image: gcr.io/k8s-staging-sp-operator/security-profiles-operator:latest
+        image: registry.k8s.io/security-profiles-operator/security-profiles-operator:v0.10.0
         imagePullPolicy: Always
         name: security-profiles-operator
         resources:
diff --git a/deploy/openshift-dev.yaml b/deploy/openshift-dev.yaml
@@ -3455,7 +3455,7 @@ spec:
               fieldPath: spec.nodeName
         - name: KUBELET_DIR
           value: /var/lib/kubelet
-        image: image-registry.openshift-image-registry.svc:5000/openshift/security-profiles-operator:latest
+        image: registry.k8s.io/security-profiles-operator/security-profiles-operator:v0.10.0
         imagePullPolicy: Always
         name: security-profiles-operator
         resources:
diff --git a/deploy/openshift-downstream.yaml b/deploy/openshift-downstream.yaml
@@ -3475,7 +3475,7 @@ spec:
               fieldPath: spec.nodeName
         - name: KUBELET_DIR
           value: /var/lib/kubelet
-        image: gcr.io/k8s-staging-sp-operator/security-profiles-operator:latest
+        image: registry.k8s.io/security-profiles-operator/security-profiles-operator:v0.10.0
         imagePullPolicy: Always
         name: security-profiles-operator
         resources:
diff --git a/deploy/operator.yaml b/deploy/operator.yaml
diff --git a/deploy/webhook-operator.yaml b/deploy/webhook-operator.yaml
diff --git a/examples/olm/install-resources.yaml b/examples/olm/install-resources.yaml
diff --git a/hack/ci/e2e-olm.sh b/hack/ci/e2e-olm.sh
diff --git a/hack/deploy-localhost.patch b/hack/deploy-localhost.patch
diff --git a/installation-usage.md b/installation-usage.md
diff --git a/test/e2e_test.go b/test/e2e_test.go
