Bump sigs.k8s.io/security-profiles-operator from 0.8.4 to 1.0.0

[dependabot]

Bumps sigs.k8s.io/security-profiles-operator from 0.8.4 to 1.0.0.

Release notes

Sourced from sigs.k8s.io/security-profiles-operator's releases.

v1.0.0

Welcome to our glorious v1.0.0 release of the security-profiles-operator! 🥳 👯

This is the first stable release of the Security Profiles Operator! All CRD APIs have been graduated from alpha/beta to v1, providing a stable API surface for managing security profiles in Kubernetes. This release was preceded by a third-party security audit that found zero critical vulnerabilities, with all identified hardening areas addressed in this release. The general usage and setup can be found in our documentation, and a dedicated v1 migration guide is available to help with upgrading from previous versions.

To install the operator, run:

$ kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/security-profiles-operator/v1.0.0/deploy/operator.yaml

You can also verify the container image signature by using cosign:

$ cosign verify \
    --certificate-identity krel-trust@k8s-releng-prod.iam.gserviceaccount.com \
    --certificate-oidc-issuer https://accounts.google.com \
    registry.k8s.io/security-profiles-operator/security-profiles-operator:v1.0.0

Besides the operator image, we now also ship spoc, the official Security Profiles Operator Command Line Interface! Binaries for amd64, arm64 and ppc64le are attached to this release.

To verify the signature of spoc, download all release artifacts and run for amd64 (works in the same way for arm64 and ppc64le):

$ cosign verify-blob \
    --certificate-identity sgrunert@redhat.com \
    --certificate-oidc-issuer https://github.com/login/oauth \
    --bundle spoc.amd64.bundle \
    spoc.amd64

We also provide .sha512 sum files for the binaries.

Feel free to provide us any kind of feedback in the official Kubernetes Slack #security-profiles-operator channel.

Changes by Kind

API Changes

• Graduate all CRD APIs from alpha/beta to v1. (#3242, @​saschagrunert)
• Replace external seccomp.Action and seccomp.Operator with SPO-owned types. (#3222, @​saschagrunert)
• Fix seccomp field types per Kubernetes API conventions. (#3223, @​saschagrunert)
• Group SPOD spec fields into substructs. (#3226, @​saschagrunert)
• Convert SPOD bool fields to *bool for three-state semantics. (#3231, @​saschagrunert)

... (truncated)

Changelog

Sourced from sigs.k8s.io/security-profiles-operator's changelog.

Releasing a new version of the security-profiles-operator

A new security-profiles-operator release can be done by overall three Pull Requests (PRs). Please ensure that no other PRs got merged in between. This can be achieved by opening a new Release vx.y.z issue and applying the tide/merge-blocker label if appropriate.

The overall process should not take longer than a couple of minutes, but it is required to have one of the repository owners at hand to be able to merge the PRs.

Run the ./hack/release.sh x.y.z script by replacing the appropriate version. The script basically:

• bumps the https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/VERSION file to the target version
• changes the images newName/newTag fields of ./https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/deploy/kustomize-deployment/kustomization.yaml from gcr.io/k8s-staging-sp-operator/security-profiles-operator to registry.k8s.io/security-profiles-operator/security-profiles-operator (newName) and the corresponding tag (newTag). has to be run and the changes have to be committed.
• changes the image in the CatalogSource in the same way at .https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/examples/olm/install-resources.yaml
• changes hack/ci/e2e-olm.sh to sed "s#registry.k8s.io/security-profiles-operator/security-profiles-operator-catalog:v0.0.0#${CATALOG_IMG}#g" instead of "s#gcr.io/k8s-staging-sp-operator/security-profiles-operator-catalog:latest#${CATALOG_IMG}#g" (please note to change the version v0.0.0 to the upcoming release)
• updates https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/dependencies.yaml spo-current version as well as its linked files. Run make verify-dependencies to verify the results.
• updates ./hack/deploy-localhost.patch to match the new deployment
• updates https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/deploy/base/clusterserviceversion.yaml to change replaces to the latest available version on OperatorHub as well as update the containerImage.
• runs make bundle

Create a new PR from the proposed changes and wait for the CI to succeed.

After this PR has been merged, we have to watch out the successful build of the container image via the automatically triggered post-security-profiles-operator-push-image post submit job in prow. All jobs of this type can be found either on the commit status on the main branch or in prow directly.

If the image got built successfully, then we can create a second PR to the k8s.io GitHub repository. This PR promotes the built container images (the manifest as well as the builds for amd64 and arm).

... (truncated)

Commits

• 3452bfb fix(selinux): use client reader to get selinux image
• 41e20d9 build(deps): bump the kubernetes group with 2 updates
• 75a8d0a Bump to v1.0.0
• b13f922 build(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1
• 6d39e39 build(deps): bump github.com/opencontainers/runc from 1.4.3 to 1.5.0
• dbe887a Generate deployments
• 0ed797e Handle insecure metrics access in ServiceMonitor
• 063a9ee Review fixes
• 65620d0 Generate deployments
• 8a47edc Fix lint warnings
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)