Uploaded image for project: 'Cloud Infrastructure Security & Compliance'
  1. Cloud Infrastructure Security & Compliance
  2. CMP-3521

The mergeStrategy doesn’t work as the profilerecording failed to be deleted

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • security-profiles-operator.v0.9.0
    • None
    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • False

      Affects Version/s: 4.20.0 + security-profiles-operator.v0.9.0 ;4.19.z + security-profiles-operator.v0.9.0 

      Description of problem:

       

      When creating a ProfileRecording with `recorder: logs` and `mergeStrategy: containers`, after workloads get deleted, the Partial profiles get generated, the  profilerecording will fail to be deleted. From the description of the profilebinding, the Active Workloads is not empty. And a warning will be fired as ”no partial profiles to merge”. Actually, all workloads have been deleted and there are 9 Partial profiles to be merged.
      % oc delete profilerecordings.security-profiles-operator.x-k8s.io spo-recording0zxq2fg685
      profilerecording.security-profiles-operator.x-k8s.io "spo-recording0zxq2fg685" deleted
      ^C%                                                                                                                                                                                                                % oc describe profilerecordings.security-profiles-operator.x-k8s.io spo-recording0zxq2fg685
      Name:         spo-recording0zxq2fg685
      Namespace:    merge-strategy-btjl206bvt
      Labels:       <none>
      Annotations:  <none>
      API Version:  security-profiles-operator.x-k8s.io/v1alpha1
      Kind:         ProfileRecording
      Metadata:
        Creation Timestamp:             2025-08-18T10:18:54Z
        Deletion Grace Period Seconds:  0
        Deletion Timestamp:             2025-08-18T10:30:52Z
        Finalizers:
          spo.x-k8s.io/has-unmerged-profiles
        Generation:        2
        Resource Version:  244268
        UID:               5a321a0a-7398-42e9-b176-8b5a0a244706
      Spec:
        Disable Profile After Recording:  false
        Kind:                             SeccompProfile
        Merge Strategy:                   containers
        Pod Selector:
          Match Labels:
            App:   hello-openshift
        Recorder:  logs
      Status:
        Active Workloads:
          hello-deployment-745bc866d7-
          hello-openshift-5785b59bb9-
      Events:
        Type     Reason             Age   From          Message
        ----     ------             ----  ----          -------
        Warning  NoPartialProfiles  25s   policymerger  no partial profiles to merge
      % oc get sp -l spo.x-k8s.io/recording-id=spo-recording0zxq2fg685
      NAME                                      STATUS    AGE
      spo-recording0zxq2fg685-nginx-2cn2q       Partial   17m
      spo-recording0zxq2fg685-nginx-hm25h       Partial   17m
      spo-recording0zxq2fg685-nginx-rlh5r       Partial   17m
      spo-recording0zxq2fg685-openshift-65ph4   Partial   14m
      spo-recording0zxq2fg685-openshift-6dbv5   Partial   14m
      spo-recording0zxq2fg685-openshift-qsxrt   Partial   14m
      spo-recording0zxq2fg685-redis-2cn2q       Partial   17m
      spo-recording0zxq2fg685-redis-hm25h       Partial   17m
      spo-recording0zxq2fg685-redis-rlh5r       Partial   17m
      % oc get deploy
      % oc get pod
      %
      

       

      Version-Release number of selected component (if applicable): 

      security-profiles-operator.v0.9.0

      How reproducible:

      Always.

      Steps to Reproduce:

       

      1. Create a ns Create a profilerecording
      $ oc apply -f -<<EOF
      apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
      kind: ProfileRecording
      metadata:
        name: test-recording
      spec:
        kind: SeccompProfile
        recorder: logs
        mergeStrategy: containers
        podSelector:
          matchLabels:
            app: hello-openshift
      EOF
      
      2. Create a sa 
      3. Create the first workload and delete it after 60 seconds 
      4. Check the partial profiles generated 
      5. Create the second workload and delete it after 60 seconds 
      6. Delete the partial profiles generated 
      7. Delete the profilebinding 

       

      Actual results:

      The profilerecording failed to be deleted. From the description of the profilerecording, the Active Workloads is not empty. And a warning will be fired as ”no partial profiles to merge”. Actually, all workloads have been deleted and there are 9 Partial profiles to be merged.

       

      Expected results:

      The profilerecording should be deleted successfully. And the mergeStrategy should work as expected.

      More information:

              Unassigned Unassigned
              xiyuan@redhat.com Xiaojie Yuan
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated: