Repository: kubernetes-sigs/security-profiles-operator
Pull request #1633 (2023-04-17 23:58:38)

build(deps): bump github.com/opencontainers/runtime-spec from 1.1.0-rc.1 to 1.1.0-rc.2
Bumps [github.com/opencontainers/runtime-spec](https://github.com/opencontainers/runtime-spec) from 1.1.0-rc.1 to 1.1.0-rc.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/opencontainers/runtime-spec/releases">github.com/opencontainers/runtime-spec's releases</a>.</em></p>
<blockquote>
<h2>v1.1.0-rc.2</h2>
<p>Vote: <a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1192">#1192</a> ( <a href="https://groups.google.com/a/opencontainers.org/g/dev/c/fnCiFoXBsiI/m/fbbmbs19EQAJ">https://groups.google.com/a/opencontainers.org/g/dev/c/fnCiFoXBsiI/m/fbbmbs19EQAJ</a> )</p>
<hr />
<h2>Changes (v1.1.0-rc.1 → v1.1.0-rc.2)</h2>
<h3>Additions</h3>
<ul>
<li>config-linux: add support for rsvd hugetlb cgroup (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1116">#1116</a>)</li>
<li>features: add <code>features.md</code> to formalize the <code>runc features</code> JSON (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1130">#1130</a>)</li>
<li>config-linux: add support for time namespace (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1151">#1151</a>)</li>
</ul>
<h3>Minor fixes and documentation</h3>
<ul>
<li>config-linux: clarify where device nodes can be created (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1148">#1148</a>)</li>
<li>runtime: remove <code>When serialized in JSON, the format MUST adhere to the following pattern</code> (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1178">#1178</a>)</li>
<li>Update CI to Go 1.20 (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1179">#1179</a>)</li>
<li>config: clarify Linux mount options (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1181">#1181</a>)</li>
<li>config-linux: fix url error (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1184">#1184</a>)</li>
<li>schema: fix schema for timeOffsets (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1193">#1193</a>)</li>
<li>schema: remove duplicate keys (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1195">#1195</a>)</li>
</ul>
<h2>Changes (v1.0.2 → v1.1.0-rc.1)</h2>
<h3>Breaking changes (but rather conforms to the existing runc implementation)</h3>
<ul>
<li>config: change prestart hook spec to match reality (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1169">#1169</a>)</li>
</ul>
<h3>Deprecations</h3>
<ul>
<li>config-linux: mark memory.kernel[TCP] as NOT RECOMMENDED (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1093">#1093</a>)</li>
</ul>
<h3>Additions</h3>
<ul>
<li>cgroup: add cgroup v2 support (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1040">#1040</a>)</li>
<li>seccomp: allow to override errno return code (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1041">#1041</a>)</li>
<li>seccomp: Add support for SCMP_ACT_KILL_PROCESS (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1044">#1044</a>)</li>
<li>Update seccomp architectures to support RISCV64 (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1059">#1059</a>)</li>
<li>Add support for SCMP_ACT_KILL_THREAD (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1064">#1064</a>)</li>
<li>Add Seccomp Notify support using UNIX sockets and container metadata (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1074">#1074</a>)</li>
<li>config-linux: Add Intel RDT CMT and MBM Linux support (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1076">#1076</a>)</li>
<li>seccomp: allow to override default errno return code (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1087">#1087</a>)</li>
<li>Introduce zos as platform (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1095">#1095</a>)</li>
<li>config-linux: add idle option for container cgroup (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1136">#1136</a>)</li>
<li>config-linux: add CFS bandwidth burst (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1120">#1120</a>)</li>
<li>IDMapping field for mount point (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1143">#1143</a>)</li>
<li>schema: add cpu idle (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1145">#1145</a>)</li>
<li>add domainname spec entity (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1156">#1156</a>)</li>
<li>config-linux: add memory.checkBeforeUpdate (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1158">#1158</a>)</li>
<li>seccomp: Add flag SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1161">#1161</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/opencontainers/runtime-spec/blob/main/ChangeLog">github.com/opencontainers/runtime-spec's changelog</a>.</em></p>
<blockquote>
<p>OpenContainers Specifications</p>
<p>Changes with v1.1.0-rc.2:</p>
<p>Additions:</p>
<ul>
<li>config-linux: add support for rsvd hugetlb cgroup (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1116">#1116</a>)</li>
<li>features: add <code>features.md</code> to formalize the <code>runc features</code> JSON (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1130">#1130</a>)</li>
<li>config-linux: add support for time namespace (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1151">#1151</a>)</li>
</ul>
<p>Minor fixes and documentation:</p>
<ul>
<li>config-linux: clarify where device nodes can be created (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1148">#1148</a>)</li>
<li>runtime: remove <code>When serialized in JSON, the format MUST adhere to the following pattern</code> (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1178">#1178</a>)</li>
<li>Update CI to Go 1.20 (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1179">#1179</a>)</li>
<li>config: clarify Linux mount options (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1181">#1181</a>)</li>
<li>config-linux: fix url error (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1184">#1184</a>)</li>
<li>schema: fix schema for timeOffsets (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1193">#1193</a>)</li>
<li>schema: remove duplicate keys (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1195">#1195</a>)</li>
</ul>
<p>Changes with v1.1.0-rc.1:</p>
<p>Breaking changes (but rather conforms to the existing runc implementation):</p>
<ul>
<li>config: change prestart hook spec to match reality (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1169">#1169</a>)</li>
</ul>
<p>Deprecations:</p>
<ul>
<li>config-linux: mark memory.kernel[TCP] as NOT RECOMMENDED (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1093">#1093</a>)</li>
</ul>
<p>Additions:</p>
<ul>
<li>cgroup: add cgroup v2 support (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1040">#1040</a>)</li>
<li>seccomp: allow to override errno return code (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1041">#1041</a>)</li>
<li>seccomp: Add support for SCMP_ACT_KILL_PROCESS (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1044">#1044</a>)</li>
<li>Update seccomp architectures to support RISCV64 (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1059">#1059</a>)</li>
<li>Add support for SCMP_ACT_KILL_THREAD (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1064">#1064</a>)</li>
<li>Add Seccomp Notify support using UNIX sockets and container metadata (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1074">#1074</a>)</li>
<li>config-linux: Add Intel RDT CMT and MBM Linux support (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1076">#1076</a>)</li>
<li>seccomp: allow to override default errno return code (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1087">#1087</a>)</li>
<li>Introduce zos as platform (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1095">#1095</a>)</li>
<li>config-linux: add idle option for container cgroup (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1136">#1136</a>)</li>
<li>config-linux: add CFS bandwidth burst (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1120">#1120</a>)</li>
<li>IDMapping field for mount point (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1143">#1143</a>)</li>
<li>schema: add cpu idle (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1145">#1145</a>)</li>
<li>add domainname spec entity (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1156">#1156</a>)</li>
<li>config-linux: add memory.checkBeforeUpdate (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1158">#1158</a>)</li>
<li>seccomp: Add flag SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV (<a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1161">#1161</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/opencontainers/runtime-spec/commit/a5b4da44adbd2d225696e5e52b5bd3b004e179cd"><code>a5b4da4</code></a> version: release v1.1.0-rc.2</li>
<li><a href="https://github.com/opencontainers/runtime-spec/commit/54f948c967dce262db0826c97b46df8526e74025"><code>54f948c</code></a> ChangeLog: Document changes since v1.1.0-rc.1</li>
<li><a href="https://github.com/opencontainers/runtime-spec/commit/2ee82c50fde339cd3bba89d441f52e0766c65e10"><code>2ee82c5</code></a> Merge pull request <a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1195">#1195</a> from cbandy/duplicate-keys</li>
<li><a href="https://github.com/opencontainers/runtime-spec/commit/6152be404b3d78bf615c9f0bab76d459bcd56abe"><code>6152be4</code></a> schema: remove duplicate keys</li>
<li><a href="https://github.com/opencontainers/runtime-spec/commit/05ff261895cf36bfd9fa84a180c80d91f3cbc8ee"><code>05ff261</code></a> Merge pull request <a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1193">#1193</a> from giuseppe/fix-time-schema</li>
<li><a href="https://github.com/opencontainers/runtime-spec/commit/b6980b01b03bd7ec89370c9ce9e3c52c0798d259"><code>b6980b0</code></a> schema: fix schema for timeOffsets</li>
<li><a href="https://github.com/opencontainers/runtime-spec/commit/dbab843a253ac233599b297948d3fe61dacac954"><code>dbab843</code></a> Merge pull request <a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1130">#1130</a> from AkihiroSuda/features</li>
<li><a href="https://github.com/opencontainers/runtime-spec/commit/689874fc76bf43d5a79cb733bcc7bcf7756bdb0e"><code>689874f</code></a> Add <code>features.md</code> to formalize the <code>runc features</code> JSON</li>
<li><a href="https://github.com/opencontainers/runtime-spec/commit/8a09257551e4e2b03fa8ec367b34b62cd3f4fcbf"><code>8a09257</code></a> Merge pull request <a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1116">#1116</a> from kailun-qin/add-hugetlb-rsvd</li>
<li><a href="https://github.com/opencontainers/runtime-spec/commit/9067ce60e4eafa978218905c4a9af3562f5415be"><code>9067ce6</code></a> Merge pull request <a href="https://redirect.github.com/opencontainers/runtime-spec/issues/1179">#1179</a> from austinvazquez/add-go-1.20</li>
<li>Additional commits viewable in <a href="https://github.com/opencontainers/runtime-spec/compare/v1.1.0-rc.1...v1.1.0-rc.2">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/opencontainers/runtime-spec&package-manager=go_modules&previous-version=1.1.0-rc.1&new-version=1.1.0-rc.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

k8s-ci-robot: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our [release note process](https://git.k8s.io/community/contributors/guide/release-notes.md) to remove it.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
k8s-ci-robot: Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a [kubernetes-sigs](https://github.com/orgs/kubernetes-sigs/people) member to verify that this patch is reasonable to test. If it is, they should reply with `/ok-to-test` on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should [join the org](https://git.k8s.io/community/community-membership.md#member) to skip this step.

Once the patch is verified, the new status will be reflected by the `ok-to-test` label.

I understand the commands that are listed [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>

k8s-ci-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1633#" title="Author self-approved">dependabot[bot]</a>*
**Once this PR has been reviewed and has the lgtm label**, please assign pjbgf for approval. For more information see [the Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["pjbgf"]} -->
codecov-commenter: ## [Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/1633?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kubernetes-sigs) Report
> Merging [#1633](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/1633?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kubernetes-sigs) (8000d5f) into [main](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/commit/b619a8f8ba2e5a9f6d502bced6f99d6a2bb1b7f3?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kubernetes-sigs) (b619a8f) will **not change** coverage.
> The diff coverage is `n/a`.

<details><summary>Additional details and impacted files</summary>


```diff
@@           Coverage Diff           @@
##             main    #1633   +/-   ##
=======================================
  Coverage   48.65%   48.65%           
=======================================
  Files          69       69           
  Lines        6785     6785           
=======================================
  Hits         3301     3301           
  Misses       3353     3353           
  Partials      131      131           
```

</details>

Patch:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 20093d940..2a7ae0786 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -106,7 +106,7 @@ jobs:
         if: github.ref == 'refs/heads/main'
       - name: Image metadata
         id: meta
-        uses: docker/metadata-action@507c2f2dc502c992ad446e3d7a5dfbe311567a96 # v4.3.0
+        uses: docker/metadata-action@c4ee3adeed93b1fa6a762f209fb01608c1a22f1e # v4.4.0
         with:
           images: |
             quay.io/security-profiles-operator/build
@@ -153,7 +153,7 @@ jobs:
         if: github.ref == 'refs/heads/main'
       - name: Image metadata
         id: meta
-        uses: docker/metadata-action@507c2f2dc502c992ad446e3d7a5dfbe311567a96 # v4.3.0
+        uses: docker/metadata-action@c4ee3adeed93b1fa6a762f209fb01608c1a22f1e # v4.4.0
         with:
           images: |
             quay.io/security-profiles-operator/spo
@@ -196,7 +196,7 @@ jobs:
         if: github.ref == 'refs/heads/main'
       - name: Image metadata
         id: meta
-        uses: docker/metadata-action@507c2f2dc502c992ad446e3d7a5dfbe311567a96
+        uses: docker/metadata-action@c4ee3adeed93b1fa6a762f209fb01608c1a22f1e
         with:
           images: |
             quay.io/security-profiles-operator/build
diff --git a/VERSION b/VERSION
index a3df0a695..d182dc916 100644
--- a/VERSION
+++ b/VERSION
@@ -1,1 +1,1 @@
-0.8.0
+0.8.1-dev
diff --git a/bundle/manifests/security-profiles-operator.clusterserviceversion.yaml b/bundle/manifests/security-profiles-operator.clusterserviceversion.yaml
index a0a2aea03..b587335a9 100644
--- a/bundle/manifests/security-profiles-operator.clusterserviceversion.yaml
+++ b/bundle/manifests/security-profiles-operator.clusterserviceversion.yaml
@@ -242,14 +242,14 @@ metadata:
     capabilities: Basic Install
     categories: Security
     containerImage: registry.k8s.io/security-profiles-operator/security-profiles-operator:v0.8.0
-    olm.skipRange: '>=0.4.1 <0.8.0'
+    olm.skipRange: '>=0.4.1 <0.8.1-dev'
     operatorframework.io/cluster-monitoring: "true"
     operatorframework.io/suggested-namespace: security-profiles-operator
     operators.openshift.io/valid-subscription: '["OpenShift Kubernetes Engine", "OpenShift
       Container Platform", "OpenShift Platform Plus"]'
     operators.operatorframework.io/builder: operator-sdk-v1.25.0
     operators.operatorframework.io/project_layout: go.kubebuilder.io/v3
-  name: security-profiles-operator.v0.8.0
+  name: security-profiles-operator.v0.8.1-dev
   namespace: placeholder
 spec:
   apiservicedefinitions: {}
@@ -870,7 +870,7 @@ spec:
                       fieldPath: spec.nodeName
                 - name: KUBELET_DIR
                   value: /var/lib/kubelet
-                image: registry.k8s.io/security-profiles-operator/security-profiles-operator:v0.8.0
+                image: gcr.io/k8s-staging-sp-operator/security-profiles-operator:latest
                 imagePullPolicy: Always
                 name: security-profiles-operator
                 resources:
@@ -978,4 +978,4 @@ spec:
   - image: quay.io/security-profiles-operator/selinuxd
     name: selinuxd
   replaces: security-profiles-operator.v0.7.1
-  version: 0.8.0
+  version: 0.8.1-dev
diff --git a/dependencies.yaml b/dependencies.yaml
index 6eaecd128..7476c56f7 100644
--- a/dependencies.yaml
+++ b/dependencies.yaml
@@ -220,7 +220,7 @@ dependencies:
       match: BOM_VERSION
 
   - name: spo-current
-    version: 0.8.0
+    version: 0.8.1-dev
     refPaths:
     - path: VERSION
       match: ^.*
@@ -248,7 +248,7 @@ dependencies:
       match: BTFHUB_COMMIT
 
   - name: flatcar
-    version: 3446.1.0
+    version: 3510.2.0
     refPaths:
     - path: hack/ci/Vagrantfile-flatcar
       match: flatcar_production_vagrant
diff --git a/deploy/catalog-preamble.json b/deploy/catalog-preamble.json
index f920fbf05..5e630c6c2 100644
--- a/deploy/catalog-preamble.json
+++ b/deploy/catalog-preamble.json
@@ -13,8 +13,8 @@
     "package": "security-profiles-operator",
     "entries": [
         {
-            "name": "security-profiles-operator.v0.8.0",
-            "skipRange": ">=0.4.1 <0.8.0"
+            "name": "security-profiles-operator.v0.8.1-dev",
+            "skipRange": ">=0.4.1 <0.8.1-dev"
         }
     ]
 }
diff --git a/deploy/helm/Chart.yaml b/deploy/helm/Chart.yaml
index b7762baf4..54d7955c1 100644
--- a/deploy/helm/Chart.yaml
+++ b/deploy/helm/Chart.yaml
@@ -2,5 +2,5 @@ apiVersion: v2
 name: security-profiles-operator
 description: "The Kubernetes Security Profiles Operator."
 type: application
-version: "0.8.0"
-appVersion: "0.8.0"
+version: "0.8.1-dev"
+appVersion: "0.8.1-dev"
diff --git a/deploy/kustomize-deployment/kustomization.yaml b/deploy/kustomize-deployment/kustomization.yaml
index fbbda904e..93930ac65 100644
--- a/deploy/kustomize-deployment/kustomization.yaml
+++ b/deploy/kustomize-deployment/kustomization.yaml
@@ -3,11 +3,11 @@ kind: Kustomization
 
 images:
 - name: security-profiles-operator
-  # # newName: gcr.io/k8s-staging-sp-operator/security-profiles-operator
-  # # newTag: latest
+  newName: gcr.io/k8s-staging-sp-operator/security-profiles-operator
+  newTag: latest
   # For images to be released:
-  newName: registry.k8s.io/security-profiles-operator/security-profiles-operator
-  newTag: v0.8.0
+  # newName: registry.k8s.io/security-profiles-operator/security-profiles-operator
+  # newTag: v0.8.1
 
 
 resources:
diff --git a/deploy/namespace-operator.yaml b/deploy/namespace-operator.yaml
index 4dd9282bd..2f7f14b57 100644
--- a/deploy/namespace-operator.yaml
+++ b/deploy/namespace-operator.yaml
@@ -3041,7 +3041,7 @@ spec:
               fieldPath: spec.nodeName
         - name: KUBELET_DIR
           value: /var/lib/kubelet
-        image: registry.k8s.io/security-profiles-operator/security-profiles-operator:v0.8.0
+        image: gcr.io/k8s-staging-sp-operator/security-profiles-operator:latest
         imagePullPolicy: Always
         name: security-profiles-operator
         resources:
diff --git a/deploy/openshift-dev.yaml b/deploy/openshift-dev.yaml
index 66ecaa88d..99198966c 100644
--- a/deploy/openshift-dev.yaml
+++ b/deploy/openshift-dev.yaml
@@ -3032,7 +3032,7 @@ spec:
               fieldPath: spec.nodeName
         - name: KUBELET_DIR
           value: /var/lib/kubelet
-        image: registry.k8s.io/security-profiles-operator/security-profiles-operator:v0.8.0
+        image: image-registry.openshift-image-registry.svc:5000/openshift/security-profiles-operator:latest
         imagePullPolicy: Always
         name: security-profiles-operator
         resources:
diff --git a/deploy/openshift-downstream.yaml b/deploy/openshift-downstream.yaml
index 89a6982d5..dd5f25978 100644
--- a/deploy/openshift-downstream.yaml
+++ b/deploy/openshift-downstream.yaml
@@ -3052,7 +3052,7 @@ spec:
               fieldPath: spec.nodeName
         - name: KUBELET_DIR
           value: /var/lib/kubelet
-        image: registry.k8s.io/security-profiles-operator/security-profiles-operator:v0.8.0
+        image: gcr.io/k8s-staging-sp-operator/security-profiles-operator:latest
         imagePullPolicy: Always
         name: security-profiles-operator
         resources:
diff --git a/deploy/operator.yaml b/deploy/operator.yaml
index 42ca54bf4..e889ea7b8 100644
--- a/deploy/operator.yaml
+++ b/deploy/operator.yaml
@@ -3039,7 +3039,7 @@ spec:
               fieldPath: spec.nodeName
         - name: KUBELET_DIR
           value: /var/lib/kubelet
-        image: registry.k8s.io/security-profiles-operator/security-profiles-operator:v0.8.0
+        image: gcr.io/k8s-staging-sp-operator/security-profiles-operator:latest
         imagePullPolicy: Always
         name: security-profiles-operator
         resources:
diff --git a/deploy/webhook-operator.yaml b/deploy/webhook-operator.yaml
index f4dc090ae..d04cd502a 100644
--- a/deploy/webhook-operator.yaml
+++ b/deploy/webhook-operator.yaml
@@ -3039,7 +3039,7 @@ spec:
               fieldPath: spec.nodeName
         - name: KUBELET_DIR
           value: /var/lib/kubelet
-        image: registry.k8s.io/security-profiles-operator/security-profiles-operator:v0.8.0
+        image: gcr.io/k8s-staging-sp-operator/security-profiles-operator:latest
         imagePullPolicy: Always
         name: security-profiles-operator
         resources:
diff --git a/examples/olm/install-resources.yaml b/examples/olm/install-resources.yaml
index 437688d42..fd2c49734 100644
--- a/examples/olm/install-resources.yaml
+++ b/examples/olm/install-resources.yaml
@@ -17,7 +17,7 @@ metadata:
   namespace: olm
 spec:
   sourceType: grpc
-  image: registry.k8s.io/security-profiles-operator/security-profiles-operator-catalog:v0.8.0
+  image: gcr.io/k8s-staging-sp-operator/security-profiles-operator-catalog:latest
 ---
 apiVersion: operators.coreos.com/v1alpha1
 kind: Subscription
diff --git a/go.mod b/go.mod
index 406417318..4469e6661 100644
--- a/go.mod
+++ b/go.mod
@@ -17,7 +17,7 @@ require (
 	github.com/nxadm/tail v1.4.8
 	github.com/opencontainers/image-spec v1.1.0-rc2.0.20221005185240-3a7f492d3f1b
 	github.com/opencontainers/runc v1.1.6
-	github.com/opencontainers/runtime-spec v1.1.0-rc.1
+	github.com/opencontainers/runtime-spec v1.1.0-rc.2
 	github.com/openshift/api v0.0.0-20221205111557-f2fbb1d1cd5e
 	github.com/pjbgf/go-apparmor v0.1.2
 	github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.64.0
diff --git a/go.sum b/go.sum
index 714a9f1fc..ee39e04f6 100644
--- a/go.sum
+++ b/go.sum
@@ -734,8 +734,8 @@ github.com/opencontainers/image-spec v1.1.0-rc2.0.20221005185240-3a7f492d3f1b h1
 github.com/opencontainers/image-spec v1.1.0-rc2.0.20221005185240-3a7f492d3f1b/go.mod h1:3OVijpioIKYWTqjiG0zfF6wvoJ4fAXGbjdZuI2NgsRQ=
 github.com/opencontainers/runc v1.1.6 h1:XbhB8IfG/EsnhNvZtNdLB0GBw92GYEFvKlhaJk9jUgA=
 github.com/opencontainers/runc v1.1.6/go.mod h1:CbUumNnWCuTGFukNXahoo/RFBZvDAgRh/smNYNOhA50=
-github.com/opencontainers/runtime-spec v1.1.0-rc.1 h1:wHa9jroFfKGQqFHj0I1fMRKLl0pfj+ynAqBxo3v6u9w=
-github.com/opencontainers/runtime-spec v1.1.0-rc.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/opencontainers/runtime-spec v1.1.0-rc.2 h1:ucBtEms2tamYYW/SvGpvq9yUN0NEVL6oyLEwDcTSrk8=
+github.com/opencontainers/runtime-spec v1.1.0-rc.2/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/runtime-tools v0.9.1-0.20221107090550-2e043c6bd626 h1:DmNGcqH3WDbV5k8OJ+esPWbqUOX5rMLR2PMvziDMJi0=
 github.com/opencontainers/selinux v1.11.0 h1:+5Zbo97w3Lbmb3PeqQtpmTkMwsW5nRI3YaLpt7tQ7oU=
 github.com/openshift/api v0.0.0-20221205111557-f2fbb1d1cd5e h1:a0EWi14QFqKNzQUrML8K800Ko+dttLPuMGQOCVIDCDY=
diff --git a/hack/ci/Vagrantfile-flatcar b/hack/ci/Vagrantfile-flatcar
index bea7564b5..b9af6c2b9 100644
--- a/hack/ci/Vagrantfile-flatcar
+++ b/hack/ci/Vagrantfile-flatcar
@@ -2,9 +2,9 @@
 # vi: set ft=ruby :
 
 Vagrant.configure("2") do |config|
-  config.vm.box = "flatcar-main"
+  config.vm.box = "flatcar-stable"
   config.vm.box_check_update = true
-  config.vm.box_url = "https://beta.release.flatcar-linux.net/amd64-usr/3446.1.0/flatcar_production_vagrant.box"
+  config.vm.box_url = "https://stable.release.flatcar-linux.net/amd64-usr/3510.2.0/flatcar_production_vagrant.box"
   memory = 8192
   cpus = 4
 
@@ -92,7 +92,7 @@ Vagrant.configure("2") do |config|
       # Install tools
       curl -sSL -o $DOWNLOAD_DIR/jq "https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux64"
       chmod +x $DOWNLOAD_DIR/jq
-      curl -sSL -o $DOWNLOAD_DIR/flatcar_developer_container.bin.bz2 "https://beta.release.flatcar-linux.net/amd64-usr/3446.1.0/flatcar_developer_container.bin.bz2"
+      curl -sSL -o $DOWNLOAD_DIR/flatcar_developer_container.bin.bz2 "https://stable.release.flatcar-linux.net/amd64-usr/3510.2.0/flatcar_developer_container.bin.bz2"
       bzcat $DOWNLOAD_DIR/flatcar_developer_container.bin.bz2 > $DOWNLOAD_DIR/flatcar_developer_container.bin
 
       curl -sSL "https://github.com/containernetworking/plugins/releases/download/${CNI_VERSION}/cni-plugins-linux-amd64-${CNI_VERSION}.tgz" | tar -C /opt/cni/bin -xz
diff --git a/hack/deploy-localhost.patch b/hack/deploy-localhost.patch
index 613dc9b22..5e6bbf305 100644
--- a/hack/deploy-localhost.patch
+++ b/hack/deploy-localhost.patch
@@ -15,7 +15,7 @@ index d7bf1964..d2a9c614 100644
                fieldPath: spec.nodeName
          - name: KUBELET_DIR
            value: /var/lib/kubelet
--        image: registry.k8s.io/security-profiles-operator/security-profiles-operator:v0.8.0
+-        image: gcr.io/k8s-staging-sp-operator/security-profiles-operator:latest
 -        imagePullPolicy: Always
 +        image: localhost/security-profiles-operator:latest
 +        imagePullPolicy: IfNotPresent
diff --git a/vendor/github.com/opencontainers/runtime-spec/specs-go/config.go b/vendor/github.com/opencontainers/runtime-spec/specs-go/config.go
index 5b4f691c7..25f4e6e82 100644
--- a/vendor/github.com/opencontainers/runtime-spec/specs-go/config.go
+++ b/vendor/github.com/opencontainers/runtime-spec/specs-go/config.go
@@ -191,6 +191,8 @@ type Linux struct {
 	IntelRdt *LinuxIntelRdt `json:"intelRdt,omitempty"`
 	// Personality contains configuration for the Linux personality syscall
 	Personality *LinuxPersonality `json:"personality,omitempty"`
+	// TimeOffsets specifies the offset for supporting time namespaces.
+	TimeOffsets map[string]LinuxTimeOffset `json:"timeOffsets,omitempty"`
 }
 
 // LinuxNamespace is the configuration for a Linux namespace
@@ -220,6 +222,8 @@ const (
 	UserNamespace LinuxNamespaceType = "user"
 	// CgroupNamespace for isolating cgroup hierarchies
 	CgroupNamespace LinuxNamespaceType = "cgroup"
+	// TimeNamespace for isolating the clocks
+	TimeNamespace LinuxNamespaceType = "time"
 )
 
 // LinuxIDMapping specifies UID/GID mappings
@@ -232,6 +236,14 @@ type LinuxIDMapping struct {
 	Size uint32 `json:"size"`
 }
 
+// LinuxTimeOffset specifies the offset for Time Namespace
+type LinuxTimeOffset struct {
+	// Secs is the offset of clock (in secs) in the container
+	Secs int64 `json:"secs,omitempty"`
+	// Nanosecs is the additional offset for Secs (in nanosecs)
+	Nanosecs uint32 `json:"nanosecs,omitempty"`
+}
+
 // POSIXRlimit type and restrictions
 type POSIXRlimit struct {
 	// Type of the rlimit to set
@@ -242,12 +254,13 @@ type POSIXRlimit struct {
 	Soft uint64 `json:"soft"`
 }
 
-// LinuxHugepageLimit structure corresponds to limiting kernel hugepages
+// LinuxHugepageLimit structure corresponds to limiting kernel hugepages.
+// Default to reservation limits if supported. Otherwise fallback to page fault limits.
 type LinuxHugepageLimit struct {
-	// Pagesize is the hugepage size
-	// Format: "<size><unit-prefix>B' (e.g. 64KB, 2MB, 1GB, etc.)
+	// Pagesize is the hugepage size.
+	// Format: "<size><unit-prefix>B' (e.g. 64KB, 2MB, 1GB, etc.).
 	Pagesize string `json:"pageSize"`
-	// Limit is the limit of "hugepagesize" hugetlb usage
+	// Limit is the limit of "hugepagesize" hugetlb reservations (if supported) or usage.
 	Limit uint64 `json:"limit"`
 }
 
@@ -382,7 +395,7 @@ type LinuxResources struct {
 	Pids *LinuxPids `json:"pids,omitempty"`
 	// BlockIO restriction configuration
 	BlockIO *LinuxBlockIO `json:"blockIO,omitempty"`
-	// Hugetlb limit (in bytes)
+	// Hugetlb limits (in bytes). Default to reservation limits if supported.
 	HugepageLimits []LinuxHugepageLimit `json:"hugepageLimits,omitempty"`
 	// Network restriction configuration
 	Network *LinuxNetwork `json:"network,omitempty"`
diff --git a/vendor/github.com/opencontainers/runtime-spec/specs-go/version.go b/vendor/github.com/opencontainers/runtime-spec/specs-go/version.go
index 8ae4227b9..1b81f3c9d 100644
--- a/vendor/github.com/opencontainers/runtime-spec/specs-go/version.go
+++ b/vendor/github.com/opencontainers/runtime-spec/specs-go/version.go
@@ -11,7 +11,7 @@ const (
 	VersionPatch = 0
 
 	// VersionDev indicates development branch. Releases will be empty string.
-	VersionDev = "-rc.1"
+	VersionDev = "-rc.2"
 )
 
 // Version is the specification version that the package types support.
diff --git a/vendor/modules.txt b/vendor/modules.txt
index b54e81859..dbd180182 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -854,7 +854,7 @@ github.com/opencontainers/runc/libcontainer/specconv
 github.com/opencontainers/runc/libcontainer/user
 github.com/opencontainers/runc/libcontainer/userns
 github.com/opencontainers/runc/libcontainer/utils
-# github.com/opencontainers/runtime-spec v1.1.0-rc.1
+# github.com/opencontainers/runtime-spec v1.1.0-rc.2
 ## explicit
 github.com/opencontainers/runtime-spec/specs-go
 # github.com/openshift/api v0.0.0-20221205111557-f2fbb1d1cd5e


Test patch:
diff --git a/hack/ci/e2e-olm.sh b/hack/ci/e2e-olm.sh
index c66566735..028cd59ce 100755
--- a/hack/ci/e2e-olm.sh
+++ b/hack/ci/e2e-olm.sh
@@ -45,7 +45,7 @@ function build_and_push_packages() {
 
     # Create a manifest with local image
     cp deploy/operator.yaml ${OPERATOR_MANIFEST}
-    sed -i "s#registry.k8s.io/security-profiles-operator.*\$#${IMG}#" ${OPERATOR_MANIFEST}
+    sed -i "s#gcr.io/k8s-staging-sp-operator/security-profiles-operator.*\$#${IMG}#" ${OPERATOR_MANIFEST}
     grep ${IMG} ${OPERATOR_MANIFEST} || exit 1
 
     # this is a kludge, we need to make sure kustomize can be overwritten
@@ -73,7 +73,7 @@ function deploy_deps() {
     kubectl -ncert-manager wait --for condition=ready pod -l app.kubernetes.io/instance=cert-manager
 
     # All installation methods run off the same catalog
-    sed -i "s#registry.k8s.io/security-profiles-operator/security-profiles-operator-catalog:v0.8.0#${CATALOG_IMG}#g" examples/olm/install-resources.yaml
+    sed -i "s#gcr.io/k8s-staging-sp-operator/security-profiles-operator-catalog:latest#${CATALOG_IMG}#g" examples/olm/install-resources.yaml
 
 }
 
diff --git a/test/e2e_test.go b/test/e2e_test.go
index 34d82e16a..eca7bb4b9 100644
--- a/test/e2e_test.go
+++ b/test/e2e_test.go
@@ -293,8 +293,8 @@ func (e *e2e) deployOperator(manifest string) {
 	// ones from the nodes
 	e.logf("Setting imagePullPolicy to '%s' in manifest: %s", e.pullPolicy, manifest)
 	e.updateManifest(manifest, "imagePullPolicy: Always", fmt.Sprintf("imagePullPolicy: %s", e.pullPolicy))
-	e.updateManifest(manifest, "image: .*registry.k8s.io/.*", fmt.Sprintf("image: %s", e.testImage))
-	e.updateManifest(manifest, "value: .*registry.k8s.io/.*", fmt.Sprintf("value: %s", e.testImage))
+	e.updateManifest(manifest, "image: .*gcr.io/k8s-staging-sp-operator/.*", fmt.Sprintf("image: %s", e.testImage))
+	e.updateManifest(manifest, "value: .*gcr.io/k8s-staging-sp-operator/.*", fmt.Sprintf("value: %s", e.testImage))
 	e.updateManifest(manifest, "value: .*quay.io/.*/selinuxd.*", fmt.Sprintf("value: %s", e.selinuxdImage))
 	if e.selinuxEnabled {
 		e.updateManifest(manifest, "enableSelinux: false", "enableSelinux: true")