Chapter 7. Security Profiles Operator

Procedure

1. In the OpenShift Container Platform web console, navigate to Ecosystem Software Catalog.
2. Search for the Security Profiles Operator, then click Install.
3. Keep the default selection of Installation mode and namespace to ensure that the Operator will be installed to the openshift-security-profiles namespace.
4. Click Install.

1. Navigate to the Ecosystem Installed Operators page.
2. Check that the Security Profiles Operator is installed in the openshift-security-profiles namespace and its status is Succeeded.

1. Navigate to the Ecosystem Installed Operators page and inspect the Status column for any errors or failures.
2. Navigate to the Workloads Pods page and check the logs in any pods in the openshift-security-profiles project that are reporting issues.

Procedure

1. Define a Namespace object:

   Example namespace-object.yaml

   apiVersion: v1
   kind: Namespace
   metadata:
       name: openshift-security-profiles
   labels:
     openshift.io/cluster-monitoring: "true"

   Copy to Clipboard Toggle word wrap

2. Create the Namespace object:

   $ oc create -f namespace-object.yaml

   Copy to Clipboard Toggle word wrap

3. Define an OperatorGroup object:

   Example operator-group-object.yaml

   apiVersion: operators.coreos.com/v1
   kind: OperatorGroup
   metadata:
     name: security-profiles-operator
     namespace: openshift-security-profiles

   Copy to Clipboard Toggle word wrap

4. Create the OperatorGroup object:

   $ oc create -f operator-group-object.yaml

   Copy to Clipboard Toggle word wrap

5. Define a Subscription object:

   Example subscription-object.yaml

   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: security-profiles-operator-sub
     namespace: openshift-security-profiles
   spec:
     channel: release-alpha-rhel-8
     installPlanApproval: Automatic
     name: security-profiles-operator
     source: redhat-operators
     sourceNamespace: openshift-marketplace

   Copy to Clipboard Toggle word wrap

6. Create the Subscription object:

   $ oc create -f subscription-object.yaml

   Copy to Clipboard Toggle word wrap

Verification

1. Verify the installation succeeded by inspecting the following CSV file:

   $ oc get csv -n openshift-security-profiles

   Copy to Clipboard Toggle word wrap

2. Verify that the Security Profiles Operator is operational by running the following command:

   $ oc get deploy -n openshift-security-profiles

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a project by running the following command:

   $ oc new-project my-namespace

   Copy to Clipboard Toggle word wrap

2. Create the SeccompProfile object:

   apiVersion: security-profiles-operator.x-k8s.io/v1beta1
   kind: SeccompProfile
   metadata:
     name: profile1
   spec:
     defaultAction: SCMP_ACT_LOG

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a pod object that defines a securityContext:

   apiVersion: v1
   kind: Pod
   metadata:
     name: test-pod
   spec:
     securityContext:
       runAsNonRoot: true
       seccompProfile:
         type: Localhost
         localhostProfile: operator/profile1.json
     containers:
       - name: test-container
         image: quay.io/security-profiles-operator/test-nginx-unprivileged:1.21
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop: [ALL]

   Copy to Clipboard Toggle word wrap

2. View the profile path of the seccompProfile.localhostProfile attribute by running the following command:

   $ oc get seccompprofile profile1 --output wide

   Copy to Clipboard Toggle word wrap

   Example output

   NAME       STATUS     AGE   SECCOMPPROFILE.LOCALHOSTPROFILE
   profile1   Installed  14s   operator/profile1.json

   Copy to Clipboard Toggle word wrap

3. View the path to the localhost profile by running the following command:

   $ oc get sp profile1 --output=jsonpath='{.status.localhostProfile}'

   Copy to Clipboard Toggle word wrap

   Example output

   operator/profile1.json

   Copy to Clipboard Toggle word wrap

4. Apply the localhostProfile output to the patch file:

   spec:
     template:
       spec:
         securityContext:
           seccompProfile:
             type: Localhost
             localhostProfile: operator/profile1.json

   Copy to Clipboard Toggle word wrap

5. Apply the profile to any other workload, such as a Deployment object, by running the following command:

   $ oc -n my-namespace patch deployment myapp --patch-file patch.yaml --type=merge

   Copy to Clipboard Toggle word wrap

   Example output

   deployment.apps/myapp patched

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a project by running the following command:

   $ oc new-project my-namespace

   Copy to Clipboard Toggle word wrap

2. Label the namespace with enable-recording=true by running the following command:

   $ oc label ns my-namespace spo.x-k8s.io/enable-recording=true

   Copy to Clipboard Toggle word wrap

3. Create a ProfileRecording object containing a recorder: logs variable:

   apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
   kind: ProfileRecording
   metadata:
     namespace: my-namespace
     name: test-recording
   spec:
     kind: SeccompProfile
     recorder: logs
     podSelector:
       matchLabels:
         app: my-app

   Copy to Clipboard Toggle word wrap

4. Create a workload to record:

   apiVersion: v1
   kind: Pod
   metadata:
     namespace: my-namespace
     name: my-pod
     labels:
       app: my-app
   spec:
     securityContext:
       runAsNonRoot: true
       seccompProfile:
         type: RuntimeDefault
     containers:
       - name: nginx
         image: quay.io/security-profiles-operator/test-nginx-unprivileged:1.21
         ports:
           - containerPort: 8080
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop: [ALL]
       - name: redis
         image: quay.io/security-profiles-operator/redis:6.2.1
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop: [ALL]

   Copy to Clipboard Toggle word wrap

5. Confirm the pod is in a Running state by entering the following command:

   $ oc -n my-namespace get pods

   Copy to Clipboard Toggle word wrap

   Example output

   NAME     READY   STATUS    RESTARTS   AGE
   my-pod   2/2     Running   0          18s

   Copy to Clipboard Toggle word wrap

6. Confirm the enricher indicates that it receives audit logs for those containers:

   $ oc -n openshift-security-profiles logs --since=1m --selector name=spod -c log-enricher

   Copy to Clipboard Toggle word wrap

   Example output

   I0523 14:19:08.747313  430694 enricher.go:445] log-enricher "msg"="audit" "container"="redis" "executable"="/usr/local/bin/redis-server" "namespace"="my-namespace" "node"="xiyuan-23-5g2q9-worker-eastus2-6rpgf" "pid"=656802 "pod"="my-pod" "syscallID"=0 "syscallName"="read" "timestamp"="1684851548.745:207179" "type"="seccomp"

   Copy to Clipboard Toggle word wrap

Verification

1. Remove the pod:

   $ oc -n my-namespace delete pod my-pod

   Copy to Clipboard Toggle word wrap

2. Confirm the Security Profiles Operator reconciles the two seccomp profiles:

   $ oc get seccompprofiles -lspo.x-k8s.io/recording-id=test-recording

   Copy to Clipboard Toggle word wrap

   Example output for seccompprofile

   NAME                   STATUS      AGE
   test-recording-nginx   Installed   2m48s
   test-recording-redis   Installed   2m48s

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a project by running the following command:

   $ oc new-project nginx-deploy

   Copy to Clipboard Toggle word wrap

2. Create a policy that can be used with a non-privileged workload by creating the following SelinuxProfile object:

   apiVersion: security-profiles-operator.x-k8s.io/v1alpha2
   kind: SelinuxProfile
   metadata:
     name: nginx-secure
   spec:
     allow:
       '@self':
         tcp_socket:
         - listen
       http_cache_port_t:
         tcp_socket:
         - name_bind
       node_t:
         tcp_socket:
         - node_bind
     inherit:
     - kind: System
       name: container

   Copy to Clipboard Toggle word wrap

3. Wait for selinuxd to install the policy by running the following command:

   $ oc wait --for=condition=ready selinuxprofile nginx-secure

   Copy to Clipboard Toggle word wrap

   Example output

   selinuxprofile.security-profiles-operator.x-k8s.io/nginx-secure condition met

   Copy to Clipboard Toggle word wrap

   The policies are placed into an emptyDir in the container owned by the Security Profiles Operator. The policies are saved in Common Intermediate Language (CIL) format in /etc/selinux.d/<name>_<namespace>.cil.

4. Access the pod by running the following command:

   $ oc -n openshift-security-profiles rsh -c selinuxd ds/spod

   Copy to Clipboard Toggle word wrap

Verification

1. View the file contents with cat by running the following command:

   $ cat /etc/selinux.d/nginx-secure.cil

   Copy to Clipboard Toggle word wrap

   Example output

   (block nginx-secure
   (blockinherit container)
   (allow process nginx-secure.process ( tcp_socket ( listen )))
   (allow process http_cache_port_t ( tcp_socket ( name_bind )))
   (allow process node_t ( tcp_socket ( node_bind )))
   )

   Copy to Clipboard Toggle word wrap

2. Verify that a policy has been installed by running the following command:

   $ semodule -l | grep nginx-secure

   Copy to Clipboard Toggle word wrap

   Example output

   nginx-secure

   Copy to Clipboard Toggle word wrap

Procedure

1. Apply the scc.podSecurityLabelSync=false label to the nginx-deploy namespace by running the following command:

   $ oc label ns nginx-deploy security.openshift.io/scc.podSecurityLabelSync=false

   Copy to Clipboard Toggle word wrap

2. Apply the privileged label to the nginx-deploy namespace by running the following command:

   $ oc label ns nginx-deploy --overwrite=true pod-security.kubernetes.io/enforce=privileged

   Copy to Clipboard Toggle word wrap

3. Obtain the SELinux profile usage string by running the following command:

   $ oc get selinuxprofile.security-profiles-operator.x-k8s.io/nginx-secure -ojsonpath='{.status.usage}'

   Copy to Clipboard Toggle word wrap

   Example output

   nginx-secure.process

   Copy to Clipboard Toggle word wrap

4. Apply the output string in the workload manifest in the .spec.containers[].securityContext.seLinuxOptions attribute:

   apiVersion: v1
   kind: Pod
   metadata:
     name: nginx-secure
     namespace: nginx-deploy
   spec:
     securityContext:
       runAsNonRoot: true
       seccompProfile:
         type: RuntimeDefault
     containers:
       - image: nginxinc/nginx-unprivileged:1.21
         name: nginx
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop: [ALL]
           seLinuxOptions:
             # NOTE: This uses an appropriate SELinux type
             type: nginx-secure.process

   Copy to Clipboard Toggle word wrap
   Important

   The SELinux type must exist before creating the workload.

Procedure

1. Create a project by running the following command:

   $ oc new-project my-namespace

   Copy to Clipboard Toggle word wrap

2. Label the namespace with enable-recording=true by running the following command:

   $ oc label ns my-namespace spo.x-k8s.io/enable-recording=true

   Copy to Clipboard Toggle word wrap

3. Create a ProfileRecording object containing a recorder: logs variable:

   apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
   kind: ProfileRecording
   metadata:
     namespace: my-namespace
     name: test-recording
   spec:
     kind: SelinuxProfile
     recorder: logs
     podSelector:
       matchLabels:
         app: my-app

   Copy to Clipboard Toggle word wrap

4. Create a workload to record:

   apiVersion: v1
   kind: Pod
   metadata:
     namespace: my-namespace
     name: my-pod
     labels:
       app: my-app
   spec:
     securityContext:
       runAsNonRoot: true
       seccompProfile:
         type: RuntimeDefault
     containers:
       - name: nginx
         image: quay.io/security-profiles-operator/test-nginx-unprivileged:1.21
         ports:
           - containerPort: 8080
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop: [ALL]
       - name: redis
         image: quay.io/security-profiles-operator/redis:6.2.1
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop: [ALL]

   Copy to Clipboard Toggle word wrap

5. Confirm the pod is in a Running state by entering the following command:

   $ oc -n my-namespace get pods

   Copy to Clipboard Toggle word wrap

   Example output

   NAME     READY   STATUS    RESTARTS   AGE
   my-pod   2/2     Running   0          18s

   Copy to Clipboard Toggle word wrap

6. Confirm the enricher indicates that it receives audit logs for those containers:

   $ oc -n openshift-security-profiles logs --since=1m --selector name=spod -c log-enricher

   Copy to Clipboard Toggle word wrap

   Example output

   I0517 13:55:36.383187  348295 enricher.go:376] log-enricher "msg"="audit" "container"="redis" "namespace"="my-namespace" "node"="ip-10-0-189-53.us-east-2.compute.internal" "perm"="name_bind" "pod"="my-pod" "profile"="test-recording_redis_6kmrb_1684331729" "scontext"="system_u:system_r:selinuxrecording.process:s0:c4,c27" "tclass"="tcp_socket" "tcontext"="system_u:object_r:redis_port_t:s0" "timestamp"="1684331735.105:273965" "type"="selinux"

   Copy to Clipboard Toggle word wrap

Verification

1. Remove the pod:

   $ oc -n my-namespace delete pod my-pod

   Copy to Clipboard Toggle word wrap

2. Confirm the Security Profiles Operator reconciles the two SELinux profiles:

   $ oc get selinuxprofiles -lspo.x-k8s.io/recording-id=test-recording

   Copy to Clipboard Toggle word wrap

   Example output for selinuxprofile

   NAME                   USAGE                                 STATE
   test-recording-nginx   test-recording-nginx.process   Installed
   test-recording-redis   test-recording-redis.process   Installed

   Copy to Clipboard Toggle word wrap

Procedure

1. Enable memory optimization by running the following command:

   $ oc -n openshift-security-profiles patch spod spod --type=merge -p '{"spec":{"enableMemoryOptimization":true}}'

   Copy to Clipboard Toggle word wrap

2. To record a security profile for a pod, the pod must be labeled with spo.x-k8s.io/enable-recording: "true":

   apiVersion: v1
   kind: Pod
   metadata:
     name: my-recording-pod
     labels:
       spo.x-k8s.io/enable-recording: "true"
   # ...

   Copy to Clipboard Toggle word wrap

Procedure

1. To view the status of the metrics service, run the following command:

   $ oc get svc/metrics -n openshift-security-profiles

   Copy to Clipboard Toggle word wrap

   Example output

   NAME      TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
   metrics   ClusterIP   10.0.0.228   <none>        443/TCP   43s

   Copy to Clipboard Toggle word wrap

2. To retrieve the metrics, query the service endpoint using the default ServiceAccount token in the openshift-security-profiles namespace by running the following command:

   $ oc run --rm -i --restart=Never --image=registry.fedoraproject.org/fedora-minimal:latest \
       -n openshift-security-profiles metrics-test -- bash -c \
       'curl -ks -H "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" https://metrics.openshift-security-profiles/metrics-spod'

   Copy to Clipboard Toggle word wrap

   Example output

   # HELP security_profiles_operator_seccomp_profile_total Counter about seccomp profile operations.
   # TYPE security_profiles_operator_seccomp_profile_total counter
   security_profiles_operator_seccomp_profile_total{operation="delete"} 1
   security_profiles_operator_seccomp_profile_total{operation="update"} 2

   Copy to Clipboard Toggle word wrap

3. To retrieve metrics from a different namespace, link the ServiceAccount to the spo-metrics-client ClusterRoleBinding by running the following command:

   $ oc get clusterrolebinding spo-metrics-client -o wide

   Copy to Clipboard Toggle word wrap

   Example output

   NAME                 ROLE                             AGE   USERS   GROUPS   SERVICEACCOUNTS
   spo-metrics-client   ClusterRole/spo-metrics-client   35m                    openshift-security-profiles/default

   Copy to Clipboard Toggle word wrap

Procedure

1. Patch the spod configuration to enable the log enricher by running the following command:

   $ oc -n openshift-security-profiles patch spod spod \
       --type=merge -p '{"spec":{"enableLogEnricher":true}}'

   Copy to Clipboard Toggle word wrap

   Example output

   securityprofilesoperatordaemon.security-profiles-operator.x-k8s.io/spod patched

   Copy to Clipboard Toggle word wrap

   Note

   The Security Profiles Operator will re-deploy the spod daemon set automatically.

2. View the audit logs by running the following command:

   $ oc -n openshift-security-profiles logs -f ds/spod log-enricher

   Copy to Clipboard Toggle word wrap

   Example output

   I0623 12:51:04.257814 1854764 deleg.go:130] setup "msg"="starting component: log-enricher"  "buildDate"="1980-01-01T00:00:00Z" "compiler"="gc" "gitCommit"="unknown" "gitTreeState"="clean" "goVersion"="go1.16.2" "platform"="linux/amd64" "version"="0.4.0-dev"
   I0623 12:51:04.257890 1854764 enricher.go:44] log-enricher "msg"="Starting log-enricher on node: 127.0.0.1"
   I0623 12:51:04.257898 1854764 enricher.go:46] log-enricher "msg"="Connecting to local GRPC server"
   I0623 12:51:04.258061 1854764 enricher.go:69] log-enricher "msg"="Reading from file /var/log/audit/audit.log"
   2021/06/23 12:51:04 Seeked /var/log/audit/audit.log - &{Offset:0 Whence:2}

   Copy to Clipboard Toggle word wrap

Procedure

1. Set the recording.spo.io webhook configuration to record only pods labeled with spo-record=true by creating the following patch file:

   spec:
     webhookOptions:
       - name: recording.spo.io
         objectSelector:
           matchExpressions:
             - key: spo-record
               operator: In
               values:
                 - "true"

   Copy to Clipboard Toggle word wrap

2. Patch the spod/spod instance by running the following command:

   $ oc -n openshift-security-profiles patch spod \
       spod -p $(cat /tmp/spod-wh.patch) --type=merge

   Copy to Clipboard Toggle word wrap

3. To view the resulting MutatingWebhookConfiguration object, run the following command:

   $ oc get MutatingWebhookConfiguration \
       spo-mutating-webhook-configuration -oyaml

   Copy to Clipboard Toggle word wrap

Procedure

1. Enable the JSON enricher by running the following command:

   # kubectl -n openshift-security-profiles patch spod spod --type=merge -p '{"spec":{"enableJsonEnricher":true}}'

   Copy to Clipboard Toggle word wrap

   Monitor the SPOD pods for correct restart and wait for all SPOD pods to show Running before proceeding.

2. Check the pods for application of the change with the following command:

   $ oc get pods -n openshift-security-profiles -l name=spod -w

   Copy to Clipboard Toggle word wrap

   Wait until all SPOD pods show Running before proceeding.

   Note

   Each configuration change triggers a restart of the SPOD pods. After applying a patch, wait for all SPOD pods to return to the Running state before continuing.

   The Audit JSON log enricher uses eBPF as a supplemental data source. While processing auditd logs from /var/log/audit/audit.log, the enricher attempts to fetch ephemeral data from /proc/<pid> directories. Due to a race condition, these files might be deleted before they can be read. To ensure data completeness, the enricher falls back to fetching the necessary information from eBPF whenever it is not found in /proc/<pid>.

Procedure

1. Configure the audit log interval to 30 seconds by using the following command:

   # kubectl -n openshift-security-profiles patch spod spod --type=merge -p '{"spec":{"enableJsonEnricher":true,"verbosity":0,"jsonEnricherOptions":{"auditLogIntervalSeconds":30}}}'

   Copy to Clipboard Toggle word wrap

   Wait until all SPOD pods show Running before proceeding. By default, audit logs go to your standard output in JSON lines format. You can send them to a file instead.

   Configure the security profiles operator to store the log file on the node. Update the security-profiles-operator-profile ConfigMap with two keys. This example yaml uses both keys to set up a host path volume at /tmp/logs.

2. Save this JSON in a file, such as patch-volume-source.json and check it using the following command:

   $ cat patch-volume-source.json

   Copy to Clipboard Toggle word wrap

   {
     "data": {
       "json-enricher-log-volume-mount-path": "/tmp/logs",
       "json-enricher-log-volume-source.json": "{\"hostPath\": {\"path\": \"/tmp/logs\",\"type\": \"DirectoryOrCreate\"}}"
     }
   }

   Copy to Clipboard Toggle word wrap
   • json-enricher-log-volume-source.json: Defines the type of volume (for example, a host path and empty directory) where logs will be stored. This must be a JSON string representing a corev1.VolumeSource object.
   • json-enricher-log-volume-mount-path: Specifies the directory path where the log file will be generated.

3. Update the config map by saving this JSON in this file called patch-volume-source.json and then update the config map with the following command:

   # kubectl patch configmap security-profiles-operator-profile -n openshift-security-profiles --patch-file patch-volume-source.json

   Copy to Clipboard Toggle word wrap

   Wait until all SPOD pods show Running before proceeding.

4. To set the audit log file path, configure the JSON log enricher with the full path to your audit log file by including the filename, using this command:

   # kubectl -n openshift-security-profiles patch spod spod --type=merge -p '{"spec":{"enableJsonEnricher":true,"verbosity":0,"jsonEnricherOptions":{"auditLogPath":"/tmp/logs/audit1.log"}}}'

   Copy to Clipboard Toggle word wrap

   Wait until all SPOD pods show Running before proceeding

Procedure

1. You configure these by patching the JSON log enricher options:

   # kubectl -n openshift-security-profiles patch spod spod --type=merge -p '{"spec":{"enableJsonEnricher":true,"verbosity":0,"jsonEnricherOptions":{"auditLogPath":"/tmp/logs/audit1.log","auditLogMaxSize":500,"auditLogMaxBackups":2,"auditLogMaxAge":10}}}'

   Copy to Clipboard Toggle word wrap

   Wait until all SPOD pods show Running before proceeding.

   • auditLogMaxSize: The maximum size (in megabytes) a log file can reach before it’s rotated (a new file is started).
   • auditLogMaxBackups: The maximum number of older, rotated log files to keep. Set to 0 for no limit.
   • auditLogMaxAge: The maximum number of days to keep old log files.

2. Increase the logging level for the JSON log enricher container to help with debugging. A value of 0 sets minimal logs. A value of 1 sets more detailed logs. You can choose either of these two levels and enable either level with the following command:

   # kubectl -n openshift-security-profiles patch spod spod --type=merge -p '{"spec":{"enableJsonEnricher":true, "verbosity": 1}}'

   Copy to Clipboard Toggle word wrap

   Wait until all SPOD pods show Running before proceeding.

Procedure

1. Create a file such as profile1.yaml with the following content:

   apiVersion: security-profiles-operator.x-k8s.io/v1beta1
   kind: SeccompProfile
   metadata:
     name: profile1
     namespace: openshift-security-profiles
   spec:
     defaultAction: SCMP_ACT_ALLOW
     syscalls:
     - action: SCMP_ACT_LOG
       names:
         - execve
         - clone
         - getpid

   Copy to Clipboard Toggle word wrap

   This profile allows all normal actions (defaultAction: SCMP_ACT_ALLOW). It specifically tells the system to log when a process tries to run a new program (execve), create a new process (clone), or get its own process ID (getpid). These actions often indicate user interaction within a pod.

2. Use`kubectl apply` to apply this SeccompProfile profile to your cluster as in the following command:

   # kubectl apply -f profile1.yaml

   Copy to Clipboard Toggle word wrap
   Note

   SPO must use the privileged SeccompProfile

3. Create a file named image_sec_comp.yaml containing the following yaml:

   apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
   kind: ProfileBinding
   metadata:
     namespace: default
     name: all-pod-binding
   spec:
     profileRef:
       kind: SeccompProfile
       name: profile1
     image: "*"

   Copy to Clipboard Toggle word wrap

4. Apply the binding using the following command:

   # kubectl apply -f image_sec_comp.yaml

   Copy to Clipboard Toggle word wrap

5. Label the namespace to activate it using the following command:

   # kubectl label ns default spo.x-k8s.io/enable-binding=true

   Copy to Clipboard Toggle word wrap

6. Create a pod using the profile:

   apiVersion: v1
   kind: Pod
   metadata:
     name: my-pod
     labels:
       app: my-app
   spec:
     securityContext:
       SeccompProfile:
         type: Localhost
         localhostProfile: operator/profile1.json
     containers:
       - name: nginx
         image: quay.io/security-profiles-operator/test-nginx:1.19.1

   Copy to Clipboard Toggle word wrap
   • type: Localhost means you are using a profile you have defined in the cluster.
   • localhostProfile: operator/profile1.json tells the pod to use the profile1 you created. The operator/ part indicates where the Security Profiles Operator stores these profiles.

7. Apply the pod definition to create the pod by running the following command:

   # kubectl apply -f my-pod.yaml

   Copy to Clipboard Toggle word wrap

8. Exec/rsh into the pod and run the following command:

   # kubectl exec -it my-nginx-pod -- /bin/sh

   Copy to Clipboard Toggle word wrap

9. Create an empty file by running this command:

   # touch /tmp/audittest/demo-file

   Copy to Clipboard Toggle word wrap

   • To monitor the advanced audit log tail, use the following command:

     # kubectl -n openshift-security-profiles logs --since=1m --selector name=spod -c json-enricher --max-log-requests 6 -f

     Copy to Clipboard Toggle word wrap

   • Alternatively, to monitor or inspect the advanced audit log file, you need to identify the node on which the pod is scheduled:

     # kubectl get pod my-pod -o wide

     Copy to Clipboard Toggle word wrap

     The audit log file specified in the auditLogPath is written to the node’s file system where the pod is running. To monitor or inspect the audit logs, you must access the node directly and check the file at the specified path such as /tmp/logs/audit1.log.

10. SSH to a node by using the following command:

    $ sudo ssh core@<node-name>

    Copy to Clipboard Toggle word wrap

11. View the audit log by using the following command:

    $ cat /tmp/logs/audit1.log

    Copy to Clipboard Toggle word wrap

    Example output

    {
    "auditID": "a1b2c3d4-e5f6-7890-abcd-111111111111",
    "cmdLine": "mkdir /tmp/audittest ",
    "executable": "/bin/bash",
    "gid": 0,
    "node": {"name": "worker-1"},
    "pid": 27184,
    "requestUID": "f011c4a3-b20e-44ed-bb91-23e03ae31b3e",
    "resource": {
    "container": "nginx",
    "namespace": "default",
    "pod": "my-pod"
    },
    "syscalls": ["getpid", "execve"],
    "timestamp": "2026-02-16T06:34:53.000Z",
    "uid": 0,
    "version": "spo/v1_alpha"
    }
    {
    "auditID": "a1b2c3d4-e5f6-7890-abcd-222222222222",
    "cmdLine": "touch /tmp/audittest/demo-file ",
    "executable": "/bin/bash",
    "gid": 0,
    "node": {"name": "worker-1"},
    "pid": 27274,
    "requestUID": "f011c4a3-b20e-44ed-bb91-23e03ae31b3e",
    "resource": {
    "container": "nginx",
    "namespace": "default",
    "pod": "my-pod"
    },
    "syscalls": ["getpid", "execve"],
    "timestamp": "2026-02-16T06:35:02.000Z",
    "uid": 0,
    "version": "spo/v1_alpha"
    }

    Copy to Clipboard Toggle word wrap

    By following above steps, you can enable and monitor audit logs in JSON lines format for your Kubernetes pods, giving you better visibility into their activities.