kubernetes-sigs/security-profiles-operator

# Kubernetes Security Profiles Operator [](https://github.com/kubernetes-sigs/security-profiles-operator/actions/workflows/build.yml) [](https://github.com/kubernetes-sigs/security-profiles-operator/actions/workflows/test.yml) [](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator) [](https://bestpractices.coreinfrastructure.org/projects/5368) [](https://github.com/orgs/security-profiles/packages) The _Security Profiles Operator_ (SPO) is an out-of-tree Kubernetes enhancement which aims to make it easier to create and use SELinux, seccomp and AppArmor security profiles in Kubernetes clusters. - [Installation and Usage](installation-usage.md) - [Container Images](https://console.cloud.google.com/gcr/images/k8s-staging-sp-operator/GLOBAL/security-profiles-operator) - [Release Process](./release.md) - [Testgrid Dashboard](https://testgrid.k8s.io/sig-node-security-profiles-operator) ## Features This is the parity of features across various security profiles supported by the SPO: | | Seccomp | SELinux | AppArmor | |-------------------------------------------|---------|---------|----------| | Profile CRD | Yes | Yes | Yes | | Install profiles in cluster | Yes | Yes | Yes | | Remove unused profiles from cluster | Yes | Yes | Yes | | Profile Recording (audit logs) | Yes | Yes | No | | Profile Recording (eBPF) | Yes | No | Yes | | Profile Binding to container images | Yes | No | No | | Audit log enrichment | Yes | Yes | Yes | | Audit In-Pod Activity JSON log enrichment | Yes | No | No | For information about the security model and what permissions each feature requires, refer to SPO's [security model](security-model.md). ## Resources The motivation behind the project can be found in the corresponding [RFC][0]. - [Architecture](doc/architecture.svg) - [Use Stories](doc/user-stories.md) - [Personas](doc/personas.md) Related Kubernetes Enhancement Proposals (KEPs) which have direct influence on this project: - [Promote seccomp to GA][1] - [Add ConfigMap support for seccomp custom profiles][2] - [Add KEP to create seccomp built-in profiles and add complain mode][3] Next to those KEPs, here are existing approaches for security profiles in the Kubernetes world: - [AppArmor Loader][4] - [OpenShift's Machine config operator, in charge of file management and security profiles on hosts][5] - [seccomp-config][6] ### Code of conduct

标签：客户端加密