kubernetessecurityPractitioner

Mastering Security Profiles Operator v1: Harden Your Kubernetes Workloads

5 min read CNCF BlogJun 26, 2026Reviewed for accuracy

Practitioner — Hands-on experience recommended

In the world of Kubernetes, security is a critical concern, and the Security Profiles Operator (SPO) addresses the cumbersome task of writing, distributing, and maintaining security profiles. By allowing you to manage these profiles as Kubernetes custom resources, SPO streamlines security management, reducing the risk of errors and improving operational efficiency.

The Security Profiles Operator leverages Custom Resource Definitions (CRDs) to define the APIs for managing security profiles. It enables you to record profiles from live workloads and bind them to pods in a declarative manner. This approach not only simplifies the management process but also provides a zero-downtime migration path from previous API versions. Conversion webhooks handle the translation between old and new API versions seamlessly, ensuring that your security configurations remain intact during upgrades. For instance, the transition from v1alpha1 to v1 is straightforward, as shown in the provided YAML example.

In production, the SPO has been available on OperatorHub since 2022 and is included in Red Hat OpenShift starting from version 4.12. This maturity means you can rely on it for critical workloads. However, be aware of the configuration parameter enableRawSelinuxProfiles, which allows cluster admins to disable raw SELinux profile support entirely. Understanding how to leverage this feature can help you tailor security settings to your environment's needs.

Key takeaways

→Utilize the Security Profiles Operator to manage security profiles as Kubernetes custom resources.
→Leverage CRDs to define APIs for managing security profiles effectively.
→Implement zero-downtime migrations with conversion webhooks for smooth upgrades.
→Record profiles from live workloads and bind them to pods declaratively.
→Configure `enableRawSelinuxProfiles` to control SELinux profile support in your cluster.

Why it matters

In production, robust security profiles are essential to protect your workloads from vulnerabilities. The SPO allows for a more manageable and less error-prone approach to implementing security measures, which can significantly reduce your attack surface.

Code examples

YAML

1# Before (v1alpha1)
2apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
3kind: ProfileRecording
4metadata:
5  name: my-recording
6spec:
7  kind: SeccompProfile
8  recorder: logs
9  mergeStrategy: none
10  podSelector:
11    matchLabels:
12      app: my-app
13
14
15# After (v1)
16apiVersion: security-profiles-operator.x-k8s.io/v1
17kind: ProfileRecording
18metadata:
19  name: my-recording
20spec:
21  kind: SeccompProfile
22  recorder: Logs
23  mergeStrategy: None
24  podSelector:
25    matchLabels:
26      app: my-app