Skip to content

Commit d19c068

Browse files
sheriff-rhsheriff-rh
authored
Merge pull request #59960 from sheriff-rh/SPO-0.7.0
2 parents 8fe0611 + b908de0 commit d19c068

File tree

5 files changed

+133
-0
lines changed

5 files changed

+133
-0
lines changed

‎modules/spo-custom-priority-class.adoc

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/security_profiles_operator/spo-advanced.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="spo-custom-priority-class_{context}"]
7+
= Setting a custom priority class name for the spod daemon pod
8+
9+
The default priority class name of the `spod` daemon pod is set to `system-node-critical`. A custom priority class name can be configured in the `spod` configuration by setting a value in the `priorityClassName` field.
10+
11+
.Procedure
12+
13+
* Configure the priority class name by running the following command:
14+
+
15+
[source,terminal]
16+
----
17+
$ oc -n openshift-security-profiles patch spod spod --type=merge -p '{"spec":{"priorityClassName":"my-priority-class"}}'
18+
----
19+
+
20+
.Example output
21+
[source,terminal]
22+
----
23+
securityprofilesoperatordaemon.openshift-security-profiles.x-k8s.io/spod patched
24+
----

‎modules/spo-daemon-requirements.adoc

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/security_profiles_operator/spo-advanced.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="spo-daemon-requirements_{context}"]
7+
= Customizing daemon resource requirements
8+
9+
The default resource requirements of the daemon container can be adjusted by using the field `daemonResourceRequirements`
10+
from the `spod` configuration.
11+
12+
.Procedure
13+
14+
* To specify the memory and cpu requests and limits of the daemon container, run the following command:
15+
+
16+
[source,terminal]
17+
----
18+
$ oc -n openshift-security-profiles patch spod spod --type merge -p \
19+
'{"spec":{"daemonResourceRequirements": { \
20+
"requests": {"memory": "256Mi", "cpu": "250m"}, \
21+
"limits": {"memory": "512Mi", "cpu": "500m"}}}}'
22+
----

‎modules/spo-memory-optimzation.adoc

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/security_profiles_operator/spo-advanced.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="spo-memory-optimization_{context}"]
7+
= Enabling memory optimization in the spod daemon
8+
9+
The controller running inside of `spod` daemon process watches all pods available in the cluster when profile recording is enabled. This can lead to very high memory usage in large clusters, resulting in the `spod` daemon running out of memory or crashing.
10+
11+
To prevent crashes, the `spod` daemon can be configured to only load the pods labeled for profile recording into the cache memory.
12+
+
13+
[NOTE]
14+
====
15+
SPO memory optimization is not enabled by default.
16+
====
17+
18+
.Procedure
19+
20+
. Enable memory optimization by running the following command:
21+
+
22+
[source,terminal]
23+
----
24+
$ oc -n openshift-security-profiles patch spod spod --type=merge -p '{"spec":{"enableMemoryOptimization":true}}'
25+
----
26+
27+
. To record a security profile for a pod, the pod must be labeled with `spo.x-k8s.io/enable-recording: "true"`:
28+
+
29+
[source,yaml]
30+
----
31+
apiVersion: v1
32+
kind: Pod
33+
metadata:
34+
name: my-recording-pod
35+
labels:
36+
spo.x-k8s.io/enable-recording: "true"
37+
----

‎security/security_profiles_operator/spo-advanced.adoc

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,12 @@ include::modules/spo-restrict-syscalls.adoc[leveloffset=+1]
1212

1313
include::modules/spo-base-syscalls.adoc[leveloffset=+1]
1414

15+
include::modules/spo-memory-optimzation.adoc[leveloffset=+1]
16+
17+
include::modules/spo-daemon-requirements.adoc[leveloffset=+1]
18+
19+
include::modules/spo-custom-priority-class.adoc[leveloffset=+1]
20+
1521
include::modules/spo-using-metrics.adoc[leveloffset=+1]
1622

1723
include::modules/spo-runtime-metrics.adoc[leveloffset=+2]

‎security/security_profiles_operator/spo-release-notes.adoc

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,50 @@ These release notes track the development of the Security Profiles Operator in {
1212

1313
For an overview of the Security Profiles Operator, see xref:../security_profiles_operator/spo-overview.adoc#[Security Profiles Operator Overview].
1414

15+
[id="spo-release-notes-0-7-1"]
16+
== Security Profiles Operator 0.7.1
17+
18+
The following advisory is available for the Security Profiles Operator 0.7.1:
19+
20+
* link:https://access.redhat.com/errata/RHSA-2023:2029[RHSA-2023:2029 - OpenShift Security Profiles Operator bug fix update]
21+
22+
[id="spo-0-7-1-new-features-and-enhancements"]
23+
=== New features and enhancements
24+
25+
* Security Profiles Operator (SPO) now automatically selects the appropriate `selinuxd` image for RHEL 8- and 9-based RHCOS systems.
26+
+
27+
[IMPORTANT]
28+
====
29+
Users that mirror images for disconnected environments must mirror both `selinuxd` images provided by the Security Profiles Operator.
30+
====
31+
32+
* You can now enable memory optimization inside of an `spod` daemon. For more information, see xref:../../security/security_profiles_operator/spo-advanced.adoc#spo-memory-optimization_spo-advanced[Enabling memory optimization in the spod daemon].
33+
+
34+
[NOTE]
35+
====
36+
SPO memory optimization is not enabled by default.
37+
====
38+
39+
* The daemon resource requirements are now configurable. For more information, see xref:../../security/security_profiles_operator/spo-advanced.adoc#spo-daemon-requirements_spo-advanced[Customizing daemon resource requirements].
40+
41+
* The priority class name is now configurable in the `spod` configuration. For more information, see xref:../../security/security_profiles_operator/spo-advanced.adoc#spo-custom-priority-class_spo-advanced[Setting a custom priority class name for the spod daemon pod].
42+
43+
[id="spo-0-7-1-deprecations"]
44+
=== Deprecated and removed features
45+
46+
* The default `nginx-1.19.1` seccomp profile is now removed from the Security Profiles Operator deployment.
47+
48+
[id="spo-0-7-1-bug-fixes"]
49+
=== Bug fixes
50+
51+
* Previously, a Security Profiles Operator (SPO) SELinux policy did not inherit low-level policy definitions from the container template. If you selected another template, such as net_container, the policy would not work because it required low-level policy definitions that only existed in the container template. This issue occurred when the SPO SELinux policy attempted to translate SELinux policies from the SPO custom format to the Common Intermediate Language (CIL) format. With this update, the container template appends to any SELinux policies that require translation from SPO to CIL. Additionally, the SPO SELinux policy can inherit low-level policy definitions from any supported policy template. (link:https://issues.redhat.com/browse/OCPBUGS-12879[*OCPBUGS-12879*])
52+
53+
[discrete]
54+
[id="spo-0-7-1-known-issue"]
55+
=== Known issue
56+
57+
* When uninstalling the Security Profiles Operator, the `MutatingWebhookConfiguration` object is not deleted and must be manually removed. As a workaround, delete the `MutatingWebhookConfiguration` object after uninstalling the Security Profiles Operator. These steps are defined in xref:../security_profiles_operator/spo-uninstalling.adoc#[Uninstalling the Security Profiles Operator]. (link:https://issues.redhat.com/browse/OCPBUGS-4687[*OCPBUGS-4687*])
58+
1559
[id="spo-release-notes-0-5-2"]
1660
== Security Profiles Operator 0.5.2
1761

0 commit comments

Comments
 (0)