-
Bug
-
Resolution: Unresolved
-
Undefined
-
None
-
security-profiles-operator.v0.9.0
-
None
-
Quality / Stability / Reliability
-
False
-
-
False
-
-
Affects Version/s: 4.20.0 + security-profiles-operator.v0.9.0 ;4.19.z + security-profiles-operator.v0.9.0
Description of problem:
When creating a ProfileRecording with `recorder: logs` and `mergeStrategy: containers`, after workloads get deleted, the Partial profiles get generated, the profilerecording will fail to be deleted. From the description of the profilebinding, the Active Workloads is not empty. And a warning will be fired as ”no partial profiles to merge”. Actually, all workloads have been deleted and there are 9 Partial profiles to be merged. % oc delete profilerecordings.security-profiles-operator.x-k8s.io spo-recording0zxq2fg685 profilerecording.security-profiles-operator.x-k8s.io "spo-recording0zxq2fg685" deleted ^C% % oc describe profilerecordings.security-profiles-operator.x-k8s.io spo-recording0zxq2fg685 Name: spo-recording0zxq2fg685 Namespace: merge-strategy-btjl206bvt Labels: <none> Annotations: <none> API Version: security-profiles-operator.x-k8s.io/v1alpha1 Kind: ProfileRecording Metadata: Creation Timestamp: 2025-08-18T10:18:54Z Deletion Grace Period Seconds: 0 Deletion Timestamp: 2025-08-18T10:30:52Z Finalizers: spo.x-k8s.io/has-unmerged-profiles Generation: 2 Resource Version: 244268 UID: 5a321a0a-7398-42e9-b176-8b5a0a244706 Spec: Disable Profile After Recording: false Kind: SeccompProfile Merge Strategy: containers Pod Selector: Match Labels: App: hello-openshift Recorder: logs Status: Active Workloads: hello-deployment-745bc866d7- hello-openshift-5785b59bb9- Events: Type Reason Age From Message ---- ------ ---- ---- ------- Warning NoPartialProfiles 25s policymerger no partial profiles to merge % oc get sp -l spo.x-k8s.io/recording-id=spo-recording0zxq2fg685 NAME STATUS AGE spo-recording0zxq2fg685-nginx-2cn2q Partial 17m spo-recording0zxq2fg685-nginx-hm25h Partial 17m spo-recording0zxq2fg685-nginx-rlh5r Partial 17m spo-recording0zxq2fg685-openshift-65ph4 Partial 14m spo-recording0zxq2fg685-openshift-6dbv5 Partial 14m spo-recording0zxq2fg685-openshift-qsxrt Partial 14m spo-recording0zxq2fg685-redis-2cn2q Partial 17m spo-recording0zxq2fg685-redis-hm25h Partial 17m spo-recording0zxq2fg685-redis-rlh5r Partial 17m % oc get deploy % oc get pod %
Version-Release number of selected component (if applicable):
security-profiles-operator.v0.9.0
How reproducible:
Always.
Steps to Reproduce:
1. Create a ns Create a profilerecording
$ oc apply -f -<<EOF
apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
kind: ProfileRecording
metadata:
name: test-recording
spec:
kind: SeccompProfile
recorder: logs
mergeStrategy: containers
podSelector:
matchLabels:
app: hello-openshift
EOF
2. Create a sa
3. Create the first workload and delete it after 60 seconds
4. Check the partial profiles generated
5. Create the second workload and delete it after 60 seconds
6. Delete the partial profiles generated
7. Delete the profilebinding
Actual results:
The profilerecording failed to be deleted. From the description of the profilerecording, the Active Workloads is not empty. And a warning will be fired as ”no partial profiles to merge”. Actually, all workloads have been deleted and there are 9 Partial profiles to be merged.
Expected results:
The profilerecording should be deleted successfully. And the mergeStrategy should work as expected.
More information: