Description of problem:
In paragraphhttps://docs.openshift.com/container-platform/4.13/security/security_profiles_operator/spo-seccomp.html#spo-recording-profiles_spo-seccomp, the namespace in below steps are not correct: 1. In Procedure 2, when creating the ProfileRecording, better to add `namespace: my-namespace` 2. In Procedure 3, when creating the pod, better to add `namespace: my-namespace` 3. In Procedure 4,the namespace in the command is wrong. Should be `oc -n my-namespace get pods` 4. In Procedure 5,the Example output is wrong. NOTE: the log out for seccompprofile and selinuxprofile is totally different. Please don't update the output for selinuxprofile when changing the output for seccompprofile. The example output should like below: I0523 14:19:08.747313 430694 enricher.go:445] log-enricher "msg"="audit" "container"="redis" "executable"="/usr/local/bin/redis-server" "namespace"="my-namespace" "node"="xiyuan-23-5g2q9-worker-eastus2-6rpgf" "pid"=656802 "pod"="my-pod" "syscallID"=0 "syscallName"="read" "timestamp"="1684851548.745:207179" "type"="seccomp" 5. In Verfication 1,the namespace in the command is wrong. Should be `oc -n my-namespace delete pod my-pod` In Verification 2, the output is wrong. Please note: the output for seccomp and selinux is different: $ oc get seccompprofiles -lspo.x-k8s.io/recording-id=test-recording -n my-namespace NAME STATUS AGE test-recording-nginx Installed 56s test-recording-redis Installed 56s
In paragraph https://docs.openshift.com/container-platform/4.13/security/security_profiles_operator/spo-seccomp.html#spo-container-profile-instances_spo-seccomp, the namespace in below steps are not set/correct: 1. In Procedure 1, when creating the ProfileRecording, better to add `namespace: my-namespace` 2. In Procedure 2, Before creating the deployment, need to label the namespace, otherwise the pod could not get running: $ oc label ns my-namespace security.openshift.io/scc.podSecurityLabelSync=false pod-security.kubernetes.io/enforce=privileged pod-security.kubernetes.io/audit=privileged pod-security.kubernetes.io/warn=privileged --overwrite=true namespace/my-namespace labeled when creating the workload, better to add `namespace: my-namespace` 3. In Procedure 3, the namespace is wrong in the command. Should be updated as below: $ oc delete deployment nginx-deploy -n my-namespace 4. In Procedure 4, better to add the namespace in the command: $ oc delete profilerecording test-recording -n my-namespace 5. In Procedure 5, the output is wrong. NOTE: the log out for seccompprofile and selinuxprofile is totally different. Should be updated as below: $ oc get seccompprofiles -lspo.x-k8s.io/recording-id=test-recording -n my-namespace NAME STATUS AGE test-recording-nginx-record Installed 55s
In https://docs.openshift.com/container-platform/4.13/security/security_profiles_operator/spo-selinux.html#spo-recording-profiles_spo-selinux, the namespace in below steps are not correct:
1. In Procedure 2, when creating the ProfileRecording, better to add `namespace: my-namespace`
2. In Procedure 3, when creating the pod, better to add `namespace: my-namespace`
3. In Procedure 4,the command is wrong. Should be `oc -n my-namespace get pods`
4. In Verfication 1,the command is wrong. Should be `oc -n my-namespace delete pod my-pod`
In https://docs.openshift.com/container-platform/4.13/security/security_profiles_operator/spo-selinux.html#spo-container-profile-instances_spo-selinux, the namespace in below steps are not set/correct: 1. In Procedure 1, when creating the ProfileRecording, better to add `namespace: my-namespace` 2. In Procedure 2, Before creating the deployment, need to label the namespace $ oc label ns my-namespace security.openshift.io/scc.podSecurityLabelSync=false pod-security.kubernetes.io/enforce=privileged pod-security.kubernetes.io/audit=privileged pod-security.kubernetes.io/warn=privileged --overwrite=true namespace/my-namespace labeled when creating the workload, better to add `namespace: my-namespace` 3. In Procedure 3, better to add the namespace in the command: $ oc delete deployment nginx-deploy -n my-namespace 4. In Procedure 4, better to add the namespace in the command: $ oc delete profilerecording test-recording -n my-namespace 5. In Procedure 5, the Example output should be: $ oc get selinuxprofiles -lspo.x-k8s.io/recording-id=test-recording -n my-namepsace NAME USAGE STATE test-recording-nginx-record test-recording-nginx-record_my-namespace.process Installed
Version-Release number of selected component (if applicable):
4.12 and 4.12+
How reproducible:
Always
Steps to Reproduce:
1. 2. 3.
Actual results:
Seen from description
Expected results:
Seen from description
Additional info:
- links to