Chapter 7. Security Profiles Operator

Procedure

1. In the OpenShift Container Platform web console, navigate to Ecosystem Software Catalog.
2. Search for the Security Profiles Operator, then click Install.
3. Keep the default selection of Installation mode and namespace to ensure that the Operator will be installed to the openshift-security-profiles namespace.
4. Click Install.

1. Navigate to the Ecosystem Installed Operators page.
2. Check that the Security Profiles Operator is installed in the openshift-security-profiles namespace and its status is Succeeded.

1. Navigate to the Ecosystem Installed Operators page and inspect the Status column for any errors or failures.
2. Navigate to the Workloads Pods page and check the logs in any pods in the openshift-security-profiles project that are reporting issues.

Procedure

1. Define a Namespace object:

   Example namespace-object.yaml

   apiVersion: v1
   kind: Namespace
   metadata:
       name: openshift-security-profiles
   labels:
     openshift.io/cluster-monitoring: "true"

2. Create the Namespace object:

   $ oc create -f namespace-object.yaml

3. Define an OperatorGroup object:

   Example operator-group-object.yaml

   apiVersion: operators.coreos.com/v1
   kind: OperatorGroup
   metadata:
     name: security-profiles-operator
     namespace: openshift-security-profiles

4. Create the OperatorGroup object:

   $ oc create -f operator-group-object.yaml

5. Define a Subscription object:

   Example subscription-object.yaml

   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: security-profiles-operator-sub
     namespace: openshift-security-profiles
   spec:
     channel: release-alpha-rhel-8
     installPlanApproval: Automatic
     name: security-profiles-operator
     source: redhat-operators
     sourceNamespace: openshift-marketplace

6. Create the Subscription object:

   $ oc create -f subscription-object.yaml

   Note

   If you are setting the global scheduler feature and enable defaultNodeSelector, you must create the namespace manually and update the annotations of the openshift-security-profiles namespace, or the namespace where the Security Profiles Operator was installed, with openshift.io/node-selector: “”. This removes the default node selector and prevents deployment failures.

Verification

1. Verify the installation succeeded by inspecting the following CSV file:

   $ oc get csv -n openshift-security-profiles

2. Verify that the Security Profiles Operator is operational by running the following command:

   $ oc get deploy -n openshift-security-profiles

Procedure

1. Create a project by running the following command:

   $ oc new-project my-namespace

2. Create the SeccompProfile object:

   apiVersion: security-profiles-operator.x-k8s.io/v1beta1
   kind: SeccompProfile
   metadata:
     name: profile1
   spec:
     defaultAction: SCMP_ACT_LOG

   The seccomp profile will be saved in /var/lib/kubelet/seccomp/operator/<namespace>/<name>.json.

   An init container creates the root directory of the Security Profiles Operator to run the Operator without root group or user ID privileges. A symbolic link is created from the rootless profile storage /var/lib/openshift-security-profiles to the default seccomp root path inside of the kubelet root /var/lib/kubelet/seccomp/operator.

Procedure

1. Create a pod object that defines a securityContext:

   apiVersion: v1
   kind: Pod
   metadata:
     name: test-pod
   spec:
     securityContext:
       runAsNonRoot: true
       seccompProfile:
         type: Localhost
         localhostProfile: operator/profile1.json
     containers:
       - name: test-container
         image: quay.io/security-profiles-operator/test-nginx-unprivileged:1.21
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop: [ALL]

2. View the profile path of the seccompProfile.localhostProfile attribute by running the following command:

   $ oc get seccompprofile profile1 --output wide

   Example output

   NAME       STATUS     AGE   SECCOMPPROFILE.LOCALHOSTPROFILE
   profile1   Installed  14s   operator/profile1.json

3. View the path to the localhost profile by running the following command:

   $ oc get sp profile1 --output=jsonpath='{.status.localhostProfile}'

   Example output

   operator/profile1.json

4. Apply the localhostProfile output to the patch file:

   spec:
     template:
       spec:
         securityContext:
           seccompProfile:
             type: Localhost
             localhostProfile: operator/profile1.json

5. Apply the profile to any other workload, such as a Deployment object, by running the following command:

   $ oc -n my-namespace patch deployment myapp --patch-file patch.yaml --type=merge

   Example output

   deployment.apps/myapp patched

Procedure

1. Create a project by running the following command:

   $ oc new-project my-namespace

2. Label the namespace with enable-recording=true by running the following command:

   $ oc label ns my-namespace spo.x-k8s.io/enable-recording=true

3. Create a ProfileRecording object containing a recorder: logs variable:

   apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
   kind: ProfileRecording
   metadata:
     namespace: my-namespace
     name: test-recording
   spec:
     kind: SeccompProfile
     recorder: logs
     podSelector:
       matchLabels:
         app: my-app

4. Create a workload to record:

   apiVersion: v1
   kind: Pod
   metadata:
     namespace: my-namespace
     name: my-pod
     labels:
       app: my-app
   spec:
     securityContext:
       runAsNonRoot: true
       seccompProfile:
         type: RuntimeDefault
     containers:
       - name: nginx
         image: quay.io/security-profiles-operator/test-nginx-unprivileged:1.21
         ports:
           - containerPort: 8080
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop: [ALL]
       - name: redis
         image: quay.io/security-profiles-operator/redis:6.2.1
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop: [ALL]

5. Confirm the pod is in a Running state by entering the following command:

   $ oc -n my-namespace get pods

   Example output

   NAME     READY   STATUS    RESTARTS   AGE
   my-pod   2/2     Running   0          18s

6. Confirm the enricher indicates that it receives audit logs for those containers:

   $ oc -n openshift-security-profiles logs --since=1m --selector name=spod -c log-enricher

   Example output

   I0523 14:19:08.747313  430694 enricher.go:445] log-enricher "msg"="audit" "container"="redis" "executable"="/usr/local/bin/redis-server" "namespace"="my-namespace" "node"="xiyuan-23-5g2q9-worker-eastus2-6rpgf" "pid"=656802 "pod"="my-pod" "syscallID"=0 "syscallName"="read" "timestamp"="1684851548.745:207179" "type"="seccomp"

Verification

1. Remove the pod:

   $ oc -n my-namespace delete pod my-pod

2. Confirm the Security Profiles Operator reconciles the two seccomp profiles:

   $ oc get seccompprofiles -lspo.x-k8s.io/recording-id=test-recording

   Example output for seccomp profile

   NAME                   STATUS      AGE
   test-recording-nginx   Installed   2m48s
   test-recording-redis   Installed   2m48s

Procedure

1. Create a project by running the following command:

   $ oc new-project nginx-deploy

2. Create a policy that can be used with a non-privileged workload by creating the following SelinuxProfile object:

   apiVersion: security-profiles-operator.x-k8s.io/v1alpha2
   kind: SelinuxProfile
   metadata:
     name: nginx-secure
   spec:
     allow:
       '@self':
         tcp_socket:
         - listen
       http_cache_port_t:
         tcp_socket:
         - name_bind
       node_t:
         tcp_socket:
         - node_bind
     inherit:
     - kind: System
       name: container

3. Wait for selinuxd to install the policy by running the following command:

   $ oc wait --for=condition=ready selinuxprofile nginx-secure

   Example output

   selinuxprofile.security-profiles-operator.x-k8s.io/nginx-secure condition met

   The policies are placed into an emptyDir in the container owned by the Security Profiles Operator. The policies are saved in Common Intermediate Language (CIL) format in /etc/selinux.d/<name>_<namespace>.cil.

4. Access the pod by running the following command:

   $ oc -n openshift-security-profiles rsh -c selinuxd ds/spod

Verification

1. View the file contents with cat by running the following command:

   $ cat /etc/selinux.d/nginx-secure.cil

   Example output

   (block nginx-secure
   (blockinherit container)
   (allow process nginx-secure.process ( tcp_socket ( listen )))
   (allow process http_cache_port_t ( tcp_socket ( name_bind )))
   (allow process node_t ( tcp_socket ( node_bind )))
   )

2. Verify that a policy has been installed by running the following command:

   $ semodule -l | grep nginx-secure

   Example output

   nginx-secure

Procedure

1. Apply the scc.podSecurityLabelSync=false label to the nginx-deploy namespace by running the following command:

   $ oc label ns nginx-deploy security.openshift.io/scc.podSecurityLabelSync=false

2. Apply the privileged label to the nginx-deploy namespace by running the following command:

   $ oc label ns nginx-deploy --overwrite=true pod-security.kubernetes.io/enforce=privileged

3. Obtain the SELinux profile usage string by running the following command:

   $ oc get selinuxprofile.security-profiles-operator.x-k8s.io/nginx-secure -ojsonpath='{.status.usage}'

   Example output

   nginx-secure.process

4. Apply the output string in the workload manifest in the .spec.containers[].securityContext.seLinuxOptions attribute:

   apiVersion: v1
   kind: Pod
   metadata:
     name: nginx-secure
     namespace: nginx-deploy
   spec:
     securityContext:
       runAsNonRoot: true
       seccompProfile:
         type: RuntimeDefault
     containers:
       - image: nginxinc/nginx-unprivileged:1.21
         name: nginx
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop: [ALL]
           seLinuxOptions:
             # NOTE: This uses an appropriate SELinux type
             type: nginx-secure.process

   Important

   The SELinux type must exist before creating the workload.

Procedure

1. Create a project by running the following command:

   $ oc new-project my-namespace

2. Label the namespace with enable-recording=true by running the following command:

   $ oc label ns my-namespace spo.x-k8s.io/enable-recording=true

3. Create a ProfileRecording object containing a recorder: logs variable:

   apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
   kind: ProfileRecording
   metadata:
     namespace: my-namespace
     name: test-recording
   spec:
     kind: SelinuxProfile
     recorder: logs
     podSelector:
       matchLabels:
         app: my-app

4. Create a workload to record:

   apiVersion: v1
   kind: Pod
   metadata:
     namespace: my-namespace
     name: my-pod
     labels:
       app: my-app
   spec:
     securityContext:
       runAsNonRoot: true
       seccompProfile:
         type: RuntimeDefault
     containers:
       - name: nginx
         image: quay.io/security-profiles-operator/test-nginx-unprivileged:1.21
         ports:
           - containerPort: 8080
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop: [ALL]
       - name: redis
         image: quay.io/security-profiles-operator/redis:6.2.1
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop: [ALL]

5. Confirm the pod is in a Running state by entering the following command:

   $ oc -n my-namespace get pods

   Example output

   NAME     READY   STATUS    RESTARTS   AGE
   my-pod   2/2     Running   0          18s

6. Confirm the enricher indicates that it receives audit logs for those containers:

   $ oc -n openshift-security-profiles logs --since=1m --selector name=spod -c log-enricher

   Example output

   I0517 13:55:36.383187  348295 enricher.go:376] log-enricher "msg"="audit" "container"="redis" "namespace"="my-namespace" "node"="ip-10-0-189-53.us-east-2.compute.internal" "perm"="name_bind" "pod"="my-pod" "profile"="test-recording_redis_6kmrb_1684331729" "scontext"="system_u:system_r:selinuxrecording.process:s0:c4,c27" "tclass"="tcp_socket" "tcontext"="system_u:object_r:redis_port_t:s0" "timestamp"="1684331735.105:273965" "type"="selinux"

Verification

1. Remove the pod:

   $ oc -n my-namespace delete pod my-pod

2. Confirm the Security Profiles Operator reconciles the two SELinux profiles:

   $ oc get selinuxprofiles -lspo.x-k8s.io/recording-id=test-recording

   Example output for SELinux profile

   NAME                   USAGE                                 STATE
   test-recording-nginx   test-recording-nginx.process   Installed
   test-recording-redis   test-recording-redis.process   Installed

Procedure

1. Enable memory optimization by running the following command:

   $ oc -n openshift-security-profiles patch spod spod --type=merge -p '{"spec":{"enableMemoryOptimization":true}}'

2. To record a security profile for a pod, the pod must be labeled with spo.x-k8s.io/enable-recording: "true":

   apiVersion: v1
   kind: Pod
   metadata:
     name: my-recording-pod
     labels:
       spo.x-k8s.io/enable-recording: "true"
   # ...

Procedure

1. To view the status of the metrics service, run the following command:

   $ oc get svc/metrics -n openshift-security-profiles

   Example output

   NAME      TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
   metrics   ClusterIP   10.0.0.228   <none>        443/TCP   43s

2. To retrieve the metrics, query the service endpoint using the default ServiceAccount token in the openshift-security-profiles namespace by running the following command:

   $ oc run --rm -i --restart=Never --image=registry.fedoraproject.org/fedora-minimal:latest \
       -n openshift-security-profiles metrics-test -- bash -c \
       'curl -ks -H "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" https://metrics.openshift-security-profiles/metrics-spod'

   Example output

   # HELP security_profiles_operator_seccomp_profile_total Counter about seccomp profile operations.
   # TYPE security_profiles_operator_seccomp_profile_total counter
   security_profiles_operator_seccomp_profile_total{operation="delete"} 1
   security_profiles_operator_seccomp_profile_total{operation="update"} 2

3. To retrieve metrics from a different namespace, link the ServiceAccount to the spo-metrics-client ClusterRoleBinding by running the following command:

   $ oc get clusterrolebinding spo-metrics-client -o wide

   Example output

   NAME                 ROLE                             AGE   USERS   GROUPS   SERVICEACCOUNTS
   spo-metrics-client   ClusterRole/spo-metrics-client   35m                    openshift-security-profiles/default

Procedure

1. Patch the spod configuration to enable the log enricher by running the following command:

   $ oc -n openshift-security-profiles patch spod spod \
       --type=merge -p '{"spec":{"enableLogEnricher":true}}'

   Example output

   securityprofilesoperatordaemon.security-profiles-operator.x-k8s.io/spod patched

   Note

   The Security Profiles Operator will re-deploy the spod daemon set automatically.

2. View the audit logs by running the following command:

   $ oc -n openshift-security-profiles logs -f ds/spod log-enricher

   Example output

   I0623 12:51:04.257814 1854764 deleg.go:130] setup "msg"="starting component: log-enricher"  "buildDate"="1980-01-01T00:00:00Z" "compiler"="gc" "gitCommit"="unknown" "gitTreeState"="clean" "goVersion"="go1.16.2" "platform"="linux/amd64" "version"="0.4.0-dev"
   I0623 12:51:04.257890 1854764 enricher.go:44] log-enricher "msg"="Starting log-enricher on node: 127.0.0.1"
   I0623 12:51:04.257898 1854764 enricher.go:46] log-enricher "msg"="Connecting to local GRPC server"
   I0623 12:51:04.258061 1854764 enricher.go:69] log-enricher "msg"="Reading from file /var/log/audit/audit.log"
   2021/06/23 12:51:04 Seeked /var/log/audit/audit.log - &{Offset:0 Whence:2}

Procedure

1. Set the recording.spo.io webhook configuration to record only pods labeled with spo-record=true by creating the following patch file:

   spec:
     webhookOptions:
       - name: recording.spo.io
         objectSelector:
           matchExpressions:
             - key: spo-record
               operator: In
               values:
                 - "true"

2. Patch the spod/spod instance by running the following command:

   $ oc -n openshift-security-profiles patch spod \
       spod -p $(cat /tmp/spod-wh.patch) --type=merge

3. To view the resulting MutatingWebhookConfiguration object, run the following command:

   $ oc get MutatingWebhookConfiguration \
       spo-mutating-webhook-configuration -oyaml

Procedure

1. Enable the JSON enricher by running the following command:

   # kubectl -n openshift-security-profiles patch spod spod --type=merge -p '{"spec":{"enableJsonEnricher":true}}'

   Monitor the SPOD pods for correct restart and wait for all SPOD pods to show Running before proceeding.

2. Check the pods for application of the change with the following command:

   $ oc get pods -n openshift-security-profiles -l name=spod -w

   Wait until all SPOD pods show Running before proceeding.

   Note

   Each configuration change triggers a restart of the SPOD pods. After applying a patch, wait for all SPOD pods to return to the Running state before continuing.

   The Audit JSON log enricher uses eBPF as a supplemental data source. While processing auditd logs from /var/log/audit/audit.log, the enricher attempts to fetch ephemeral data from /proc/<pid> directories. Due to a race condition, these files might be deleted before they can be read. To ensure data completeness, the enricher falls back to fetching the necessary information from eBPF whenever it is not found in /proc/<pid>.

Procedure

1. Configure the audit log interval to 30 seconds by using the following command:

   # kubectl -n openshift-security-profiles patch spod spod --type=merge -p '{"spec":{"enableJsonEnricher":true,"verbosity":0,"jsonEnricherOptions":{"auditLogIntervalSeconds":30}}}'

   Wait until all SPOD pods show Running before proceeding. By default, audit logs go to your standard output in JSON lines format. You can send them to a file instead.

   Configure the Security Profiles Operator to store the log file on the node. Update the security-profiles-operator-profile configmap with two keys. This example YAML uses both keys to set up a host path volume at /tmp/logs.

2. Create a file such as patch-volume-source.json that contains the following content:

   {
     "data": {
       "json-enricher-log-volume-mount-path": "/tmp/logs",
       "json-enricher-log-volume-source.json": "{\"hostPath\": {\"path\": \"/tmp/logs\",\"type\": \"DirectoryOrCreate\"}}"
     }
   }

   • json-enricher-log-volume-source.json: Defines the type of volume (for example, a host path and empty directory) where logs are stored. This value must be a JSON string that represents a corev1.VolumeSource object.
   • json-enricher-log-volume-mount-path: Specifies the directory path where the log file is generated.

3. Verify the file contents by running the following command:

   $ cat patch-volume-source.json

4. Update the security-profiles-operator-profile configmap by using the following command:

   # kubectl patch configmap security-profiles-operator-profile -n openshift-security-profiles --patch-file patch-volume-source.json

   Wait until all SPOD pods show Running before proceeding.

5. Set the audit log file path by configuring the JSON log enricher with the full path to your audit log file, including the file name, by running the following command:

   # kubectl -n openshift-security-profiles patch spod spod --type=merge -p '{"spec":{"enableJsonEnricher":true,"verbosity":0,"jsonEnricherOptions":{"auditLogPath":"/tmp/logs/audit1.log"}}}'

   Wait until all SPOD pods show Running before proceeding.

Procedure

1. You configure these by patching the JSON log enricher options:

   # kubectl -n openshift-security-profiles patch spod spod --type=merge -p '{"spec":{"enableJsonEnricher":true,"verbosity":0,"jsonEnricherOptions":{"auditLogPath":"/tmp/logs/audit1.log","auditLogMaxSize":500,"auditLogMaxBackups":2,"auditLogMaxAge":10}}}'

   Wait until all SPOD pods show Running before proceeding.

   • auditLogMaxSize: The maximum size (in megabytes) a log file can reach before it’s rotated (a new file is started).
   • auditLogMaxBackups: The maximum number of older, rotated log files to keep. Set to 0 for no limit.
   • auditLogMaxAge: The maximum number of days to keep old log files.

2. Increase the logging level for the JSON log enricher container to help with debugging. A value of 0 sets minimal logs. A value of 1 sets more detailed logs. You can choose either of these two levels and enable either level with the following command:

   # kubectl -n openshift-security-profiles patch spod spod --type=merge -p '{"spec":{"enableJsonEnricher":true, "verbosity": 1}}'

   Wait until all SPOD pods show Running before proceeding.

Procedure

1. Create a file such as profile1.yaml with the following content:

   apiVersion: security-profiles-operator.x-k8s.io/v1beta1
   kind: SeccompProfile
   metadata:
     name: profile1
     namespace: openshift-security-profiles
   spec:
     defaultAction: SCMP_ACT_ALLOW
     syscalls:
     - action: SCMP_ACT_LOG
       names:
         - execve
         - clone
         - getpid

   This profile allows all normal actions (defaultAction: SCMP_ACT_ALLOW). It specifically tells the system to log when a process tries to run a new program (execve), create a new process (clone), or get its own process ID (getpid). These actions often indicate user interaction within a pod.

2. Apply this SeccompProfile to your cluster by running the following command:

   # kubectl apply -f profile1.yaml

   Note

   The Security Profiles Operator must use the privileged SeccompProfile.

3. Create a file named image_sec_comp.yaml that contains the following YAML:

   apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
   kind: ProfileBinding
   metadata:
     namespace: default
     name: all-pod-binding
   spec:
     profileRef:
       kind: SeccompProfile
       name: profile1
     image: "*"

4. Apply the binding by running the following command:

   # kubectl apply -f image_sec_comp.yaml

5. Label the namespace to activate the binding by running the following command:

   # kubectl label ns default spo.x-k8s.io/enable-binding=true

6. Create a file such as my-pod.yaml that contains the following pod definition:

   apiVersion: v1
   kind: Pod
   metadata:
     name: my-pod
     labels:
       app: my-app
   spec:
     securityContext:
       seccompProfile:
         type: Localhost
         localhostProfile: operator/profile1.json
     containers:
       - name: nginx
         image: quay.io/security-profiles-operator/test-nginx:1.19.1

   • type: Localhost means you are using a profile that you defined in the cluster.
   • localhostProfile: operator/profile1.json tells the pod to use the profile1 profile that you created. The operator/ path is where the Security Profiles Operator stores these profiles.

7. Apply the pod definition by running the following command:

   # kubectl apply -f my-pod.yaml

8. Open a shell in the pod by running the following command:

   # kubectl exec -it my-pod -- /bin/sh

9. Create an empty file in the pod by running the following command:

   # touch /tmp/audittest/demo-file

10. Stream the advanced audit log by running the following command:

    # kubectl -n openshift-security-profiles logs --since=1m --selector name=spod -c json-enricher --max-log-requests 6 -f

11. Identify the node where the pod runs by running the following command:

    # kubectl get pod my-pod -o wide

    The audit log file specified in the auditLogPath field is written to the file system on the node where the pod is running. To inspect the audit logs, access the node and open the file at the configured path, such as /tmp/logs/audit1.log.

12. Access the node by running the following command:

    $ sudo ssh core@<node_name>

13. View the audit log by running the following command:

    $ cat /tmp/logs/audit1.log

    Example output

    {
    "auditID": "a1b2c3d4-e5f6-7890-abcd-111111111111",
    "cmdLine": "mkdir /tmp/audittest ",
    "executable": "/bin/bash",
    "gid": 0,
    "node": {"name": "worker-1"},
    "pid": 27184,
    "requestUID": "f011c4a3-b20e-44ed-bb91-23e03ae31b3e",
    "resource": {
    "container": "nginx",
    "namespace": "default",
    "pod": "my-pod"
    },
    "syscalls": ["getpid", "execve"],
    "timestamp": "2026-02-16T06:34:53.000Z",
    "uid": 0,
    "version": "spo/v1_alpha"
    }
    {
    "auditID": "a1b2c3d4-e5f6-7890-abcd-222222222222",
    "cmdLine": "touch /tmp/audittest/demo-file ",
    "executable": "/bin/bash",
    "gid": 0,
    "node": {"name": "worker-1"},
    "pid": 27274,
    "requestUID": "f011c4a3-b20e-44ed-bb91-23e03ae31b3e",
    "resource": {
    "container": "nginx",
    "namespace": "default",
    "pod": "my-pod"
    },
    "syscalls": ["getpid", "execve"],
    "timestamp": "2026-02-16T06:35:02.000Z",
    "uid": 0,
    "version": "spo/v1_alpha"
    }

Procedure

1. Stream the advanced audit log by using the following command:

   # kubectl -n openshift-security-profiles logs --since=1m --selector name=spod -c json-enricher --max-log-requests 6 -f

2. Identify the node on which the pod is scheduled by using the following command:

   # kubectl get pod my-pod -o wide

3. Access the node by using the following command:

   $ sudo ssh core@<node_name>

4. View the audit log by using the following command:

   $ cat /tmp/logs/audit1.log

   Example output

   {
   "auditID": "a1b2c3d4-e5f6-7890-abcd-111111111111",
   "cmdLine": "mkdir /tmp/audittest ",
   "executable": "/bin/bash",
   "gid": 0,
   "node": {"name": "worker-1"},
   "pid": 27184,
   "requestUID": "f011c4a3-b20e-44ed-bb91-23e03ae31b3e",
   "resource": {
   "container": "nginx",
   "namespace": "default",
   "pod": "my-pod"
   },
   "syscalls": ["getpid", "execve"],
   "timestamp": "2026-02-16T06:34:53.000Z",
   "uid": 0,
   "version": "spo/v1_alpha"
   }
   {
   "auditID": "a1b2c3d4-e5f6-7890-abcd-222222222222",
   "cmdLine": "touch /tmp/audittest/demo-file ",
   "executable": "/bin/bash",
   "gid": 0,
   "node": {"name": "worker-1"},
   "pid": 27274,
   "requestUID": "f011c4a3-b20e-44ed-bb91-23e03ae31b3e",
   "resource": {
   "container": "nginx",
   "namespace": "default",
   "pod": "my-pod"
   },
   "syscalls": ["getpid", "execve"],
   "timestamp": "2026-02-16T06:35:02.000Z",
   "uid": 0,
   "version": "spo/v1_alpha"
   }

Procedure

1. SSH into the target node using the following command:

   # ssh core@<node_ip_address>

2. Check to see if the files are there:

   # ls /var/lib/kubelet/seccomp/operator/

   Example output

   # kubelet-config.json  profile1.json

3. Stop the kubelet with the following commands:

   # systemctl stop kubelet

4. Stop CRI-O with the command:

   # systemctl stop crio

5. Set the CRI-O options with the following command:

   # echo "CRIO_CONFIG_OPTIONS --privileged-seccomp-profile=/var/lib/kubelet/seccomp/operator/profile1.json" > /etc/sysconfig/crio

6. Now restart the kubelet with this command:

   # systemctl start kubelet

7. Restart CRI-O with this command:

   # systemctl start crio

8. To audit kubectl debug sessions, run the following command:

   # kubectl debug node/<node_name> -it --image=ubuntu -- bash

   Create the file on the container for the debugging information.

9. chroot to the host with this command:

   # chroot /host

10. Go into the /tmp directory with this command:

    # cd /tmp

11. Create an empty file named demonodedebug with this command:

    # touch demonodedebug

12. Exit the node with the command:

    # exit

13. To monitor the logs, SSH to a node with this command:

    $ sudo ssh core@<node_name>

14. View the audit log using this command:

    $ cat /tmp/logs/audit1.log

    Example output

    {
      "auditID": "edce381a-998d-4f3f-99d8-d0c4d0c8a613",
      "cmdLine": "touch demonodedebug",
      "executable": "/usr/bin/bash",
      "gid": 0,
      "node": {"name": "worker-1"},
      "pid": 99086,
      "resource": {
        "container": "container-00",
        "namespace": "openshift-security-profiles",
        "pod": "worker-1-debug"
      },
      "syscalls": ["execve", "getpid"],
      "timestamp": "2026-02-12T13:50:11.000Z",
      "uid": 0,
      "version": "spo/v1_alpha"
    }

Procedure

1. Start the pod by running the following command:

   $ oc exec my-pod -c nginx -- sh -c "touch /tmp/testfile.txt"

2. Identify the node where the pod is running:

   $ NODE=$(oc get pod my-pod -o jsonpath='{.spec.nodeName}')

3. Access the node and check the JSON enriched audit log using the following commands:

   # oc debug node/$NODE
   # chroot /host
   # grep "testfile" /tmp/logs/audit1.log | jq .

1. The first listing is the container runtime wrapper.

   {
     "auditID": "062e2bd2-xxxx-xxxx-xxxx-57fb39d65a99",
     "cmdLine": "env SPO_EXEC_REQUEST_UID=aec3e0e1-xxxx-xxxx-xxxx-a7c58241f1a9 sh -c touch /tmp/testfile.txt ",
     "executable": "/usr/bin/crun",
     "pid": 144966,
     "requestUID": "aec3e0e1-xxxx-xxxx-xxxx-a7c58241f1a9",
     "resource": {
       "container": "nginx",
       "namespace": "default",
       "pod": "my-pod"
     },
     "node": {
       "name": "worker-1"
     },
     "syscalls": ["execve", "getpid", "clone"],
     "timestamp": "2026-02-16T14:01:07.000Z"
   }

2. The second listing is the actual command executed.

   {
     "auditID": "d586679d-xxxx-xxxx-xxxx-9dc8ab273065",
     "cmdLine": "touch /tmp/testfile.txt ",
     "executable": "/bin/dash",
     "pid": 144968,
     "requestUID": "aec3e0e1-xxxx-xxxx-xxxx-a7c58241f1a9", // Correlation key
     "resource": {
       "container": "nginx",
       "namespace": "default",
       "pod": "my-pod"
     },
     "node": {
       "name": "worker-1"
     },
     "syscalls": ["execve"],
     "timestamp": "2026-02-16T14:01:07.000Z"
   }

3. You can search the Kubernetes API audit log by using the requestUID with the following command:

   $ oc adm node-logs --role=master --path=kube-apiserver/audit.log | grep request_UID

Procedure

1. Edit the spod security profile by running the following command:

   $ oc edit spod spod -n openshift-security-profiles

2. Add webhookOptions to the spec. Locate the spec section and add the following webhookOptions block to instruct the webhook to apply to a specific namespace.

   spec:
     webhookOptions:
       - name: execmetadata.spo.io # or nodedebuggingpod.spo.io
         namespaceSelector:
         #...add rules

   After saving your changes, the Operator reconfigures the mutating webhook, allowing request details to be passed into oc exec sessions cluster-wide.

Procedure

1. Delete the test pod with the following command:

   oc delete pod my-pod

2. Delete the seccompProfile using this command:

   oc delete seccompprofile profile1 -n openshift-security-profiles

3. Disable the JSON Log Enricher and reset all options:

   oc patch spod spod -n openshift-security-profiles --type merge -p '{ "spec": { "enableJsonEnricher": false, "jsonEnricherOptions": { "auditLogPath": "", "auditLogMaxSize": 0, "auditLogMaxBackups": 0, "auditLogMaxAge": 0, "auditLogIntervalSeconds": 0 } }}'

4. Wait for spod pods to restart. Run the following command to check:

   oc get pods -n openshift-security-profiles -l name=spod -w

   Wait until all spod pods show Running.

5. Revert the ConfigMap volume patch with the following command:

   oc patch configmap security-profiles-operator-profile -n openshift-security-profiles --type merge -p '{"data":{"patch-volume-source.json":""}}'

6. Verify that the configuration has been successfully updated:

   oc get spod spod -n openshift-security-profiles -o jsonpath='{.spec.enableJsonEnricher}'

   Expected output:

   false

Procedure

1. Confirm that the profile is reconciled by running the following command:

   $ oc -n openshift-security-profiles logs openshift-security-profiles-<id>

   Example output

   I1019 19:34:14.942464       1 main.go:90] setup "msg"="starting openshift-security-profiles"  "buildDate"="2020-10-19T19:31:24Z" "compiler"="gc" "gitCommit"="a3ef0e1ea6405092268c18f240b62015c247dd9d" "gitTreeState"="dirty" "goVersion"="go1.15.1" "platform"="linux/amd64" "version"="0.2.0-dev"
   I1019 19:34:15.348389       1 listener.go:44] controller-runtime/metrics "msg"="metrics server is starting to listen"  "addr"=":8080"
   I1019 19:34:15.349076       1 main.go:126] setup "msg"="starting manager"
   I1019 19:34:15.349449       1 internal.go:391] controller-runtime/manager "msg"="starting metrics server"  "path"="/metrics"
   I1019 19:34:15.350201       1 controller.go:142] controller "msg"="Starting EventSource" "controller"="profile" "reconcilerGroup"="security-profiles-operator.x-k8s.io" "reconcilerKind"="SeccompProfile" "source"={"Type":{"metadata":{"creationTimestamp":null},"spec":{"defaultAction":""}}}
   I1019 19:34:15.450674       1 controller.go:149] controller "msg"="Starting Controller" "controller"="profile" "reconcilerGroup"="security-profiles-operator.x-k8s.io" "reconcilerKind"="SeccompProfile"
   I1019 19:34:15.450757       1 controller.go:176] controller "msg"="Starting workers" "controller"="profile" "reconcilerGroup"="security-profiles-operator.x-k8s.io" "reconcilerKind"="SeccompProfile" "worker count"=1
   I1019 19:34:15.453102       1 profile.go:148] profile "msg"="Reconciled profile from SeccompProfile" "namespace"="openshift-security-profiles" "profile"="nginx-1.19.1" "name"="nginx-1.19.1" "resource version"="728"
   I1019 19:34:15.453618       1 profile.go:148] profile "msg"="Reconciled profile from SeccompProfile" "namespace"="openshift-security-profiles" "profile"="openshift-security-profiles" "name"="openshift-security-profiles" "resource version"="729"

2. Confirm that the seccomp profiles are saved into the correct path by running the following command:

   $ oc exec -t -n openshift-security-profiles openshift-security-profiles-<id> \
       -- ls /var/lib/kubelet/seccomp/operator/my-namespace/my-workload

   Example output

   profile-block.json
   profile-complain.json

Procedure

1. Navigate to the Ecosystem Installed Operators page.
2. Delete all seccomp profiles, SELinux profiles, and webhook configurations.
3. Switch to the Administration Ecosystem Installed Operators page.
4. Click the Options menu on the Security Profiles Operator entry.
5. Select Uninstall Operator.
6. Switch to the Home Projects page.
7. Search for security profiles.
8. Click the Options menu next to the openshift-security-profiles project.

9. Select Delete Project.

   1. Enter openshift-security-profiles in the dialog box.
   2. Click Delete.

10. Delete the MutatingWebhookConfiguration object by running the following command:

    $ oc delete MutatingWebhookConfiguration spo-mutating-webhook-configuration