Repository: kubernetes-sigs/security-profiles-operator
Pull request #846 (2022-03-18 07:07:06)

Add ability to patch "problematic" pods
#### What type of PR is this?

/kind feature
/kind design
/kind api-change

#### What this PR does / why we need it:

It's often useful to know what pods are having issues with policies (be
it SELinux or Seccomp). To enable administrators to easily fetch pods
with denials registered to them, this adds the ability for the log
enricher to detect this and label a pod appropriately with the following
label:

```
spo.x-k8s.io/had-denials: ''
```

By relying on a label, we're able to easily fetch the pods with a call
such as follows:

```
kubectl get pods -A -l spo.x-k8s.io/had-denials=
```

#### Which issue(s) this PR fixes:

None

#### Does this PR have test?

Yes

#### Special notes for your reviewer:

#### Does this PR introduce a user-facing change?

```release-note
This PR includes the ability to tag pods that present denials from either Seccomp or SELinux. This will happen through the 'spo.x-k8s.io/had-denials' label.
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/846#" title="Author self-approved">JAORMX</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [JAORMX]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
k8s-ci-robot: @JAORMX: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-unit | 8bbbbd1a6c64845b2048261be52ff0b1d73fe9e5 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-unit/1504716010043740160) | true | `/test pull-security-profiles-operator-test-unit`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-unit | 8bbbbd1a6c64845b2048261be52ff0b1d73fe9e5 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-unit/1504716010043740160) | true | `/test pull-security-profiles-operator-test-unit`
pull-security-profiles-operator-verify | 8bbbbd1a6c64845b2048261be52ff0b1d73fe9e5 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-verify/1504716010001797120) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | 8bbbbd1a6c64845b2048261be52ff0b1d73fe9e5 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-verify/1504716010001797120) | true | `/test pull-security-profiles-operator-verify`
pull-security-profiles-operator-test-unit | 23df4a5f56a2eb4b8ed73caa2bf85e261da33dc9 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-unit/1504719632806711296) | true | `/test pull-security-profiles-operator-test-unit`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-unit | 23df4a5f56a2eb4b8ed73caa2bf85e261da33dc9 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-unit/1504719632806711296) | true | `/test pull-security-profiles-operator-test-unit`
pull-security-profiles-operator-verify | 23df4a5f56a2eb4b8ed73caa2bf85e261da33dc9 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-verify/1504719632752185344) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-unit | 23df4a5f56a2eb4b8ed73caa2bf85e261da33dc9 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-unit/1504719632806711296) | true | `/test pull-security-profiles-operator-test-unit`
pull-security-profiles-operator-verify | 23df4a5f56a2eb4b8ed73caa2bf85e261da33dc9 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-verify/1504719632752185344) | true | `/test pull-security-profiles-operator-verify`
pull-security-profiles-operator-test-e2e | 23df4a5f56a2eb4b8ed73caa2bf85e261da33dc9 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-e2e/1504719632940929024) | true | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-unit | 23df4a5f56a2eb4b8ed73caa2bf85e261da33dc9 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-unit/1504719632806711296) | true | `/test pull-security-profiles-operator-test-unit`
pull-security-profiles-operator-test-e2e | 23df4a5f56a2eb4b8ed73caa2bf85e261da33dc9 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-e2e/1504719632940929024) | true | `/test pull-security-profiles-operator-test-e2e`
pull-security-profiles-operator-verify | 0b8f72f12a534d090f36436e18be42edac971814 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-verify/1504799390517170176) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 23df4a5f56a2eb4b8ed73caa2bf85e261da33dc9 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-e2e/1504719632940929024) | true | `/test pull-security-profiles-operator-test-e2e`
pull-security-profiles-operator-verify | 0b8f72f12a534d090f36436e18be42edac971814 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-verify/1504799390517170176) | true | `/test pull-security-profiles-operator-verify`
pull-security-profiles-operator-test-unit | 0b8f72f12a534d090f36436e18be42edac971814 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-unit/1504799390559113216) | true | `/test pull-security-profiles-operator-test-unit`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 23df4a5f56a2eb4b8ed73caa2bf85e261da33dc9 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-e2e/1504719632940929024) | true | `/test pull-security-profiles-operator-test-e2e`
pull-security-profiles-operator-verify | 0b8f72f12a534d090f36436e18be42edac971814 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-verify/1504799390517170176) | true | `/test pull-security-profiles-operator-verify`
pull-security-profiles-operator-test-unit | 191c84d96fcea8e9c48a57172c973dbfb3bac2c9 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-unit/1504801416001097728) | true | `/test pull-security-profiles-operator-test-unit`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 23df4a5f56a2eb4b8ed73caa2bf85e261da33dc9 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-e2e/1504719632940929024) | true | `/test pull-security-profiles-operator-test-e2e`
pull-security-profiles-operator-verify | 0b8f72f12a534d090f36436e18be42edac971814 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-verify/1504799390517170176) | true | `/test pull-security-profiles-operator-verify`
pull-security-profiles-operator-test-unit | ecc30c693359ff1398a64a8ec21784157850653c | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-unit/1504801864745488384) | true | `/test pull-security-profiles-operator-test-unit`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 23df4a5f56a2eb4b8ed73caa2bf85e261da33dc9 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-e2e/1504719632940929024) | true | `/test pull-security-profiles-operator-test-e2e`
pull-security-profiles-operator-test-unit | ecc30c693359ff1398a64a8ec21784157850653c | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-unit/1504801864745488384) | true | `/test pull-security-profiles-operator-test-unit`
pull-security-profiles-operator-verify | ecc30c693359ff1398a64a8ec21784157850653c | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-verify/1504801864716128256) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | ecc30c693359ff1398a64a8ec21784157850653c | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-verify/1504801864716128256) | true | `/test pull-security-profiles-operator-verify`
pull-security-profiles-operator-test-unit | b57c6449fbb5031270fba3b91fd7828214756e52 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-unit/1507280190168895488) | true | `/test pull-security-profiles-operator-test-unit`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-unit | b57c6449fbb5031270fba3b91fd7828214756e52 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-unit/1507280190168895488) | true | `/test pull-security-profiles-operator-test-unit`
pull-security-profiles-operator-verify | b57c6449fbb5031270fba3b91fd7828214756e52 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-verify/1507280190135341056) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | b57c6449fbb5031270fba3b91fd7828214756e52 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-verify/1507280190135341056) | true | `/test pull-security-profiles-operator-verify`
pull-security-profiles-operator-test-unit | b1b7cc8fb3185c8777c2f9cd3cc7cab9e1670f77 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-unit/1509114799638712320) | true | `/test pull-security-profiles-operator-test-unit`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-unit | b1b7cc8fb3185c8777c2f9cd3cc7cab9e1670f77 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-unit/1509114799638712320) | true | `/test pull-security-profiles-operator-test-unit`
pull-security-profiles-operator-verify | b1b7cc8fb3185c8777c2f9cd3cc7cab9e1670f77 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-verify/1509114799609352192) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | b1b7cc8fb3185c8777c2f9cd3cc7cab9e1670f77 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-verify/1509114799609352192) | true | `/test pull-security-profiles-operator-verify`
pull-security-profiles-operator-test-unit | cb5aaa380173b05bae93d18c88aff0cc155d3ff4 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-unit/1509118013624815616) | true | `/test pull-security-profiles-operator-test-unit`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-unit | 622fcd63434f428da098212fb79f3b2191dc83a9 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-unit/1509123660026220544) | true | `/test pull-security-profiles-operator-test-unit`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-unit | d398cc896ed48a3d09df61c6436e9564c999c249 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-unit/1509124623390740480) | true | `/test pull-security-profiles-operator-test-unit`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-unit | 82e98899de319eda2e1f6698c2e940a2b647a423 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-unit/1509126246401839104) | true | `/test pull-security-profiles-operator-test-unit`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
codecov-commenter: # [Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/846?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) Report
> Merging [#846](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/846?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) (63988de) into [main](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/commit/10db6213619dfb2502ab3103ad0e298e7921034e?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) (10db621) will **decrease** coverage by `0.44%`.
> The diff coverage is `35.80%`.


```diff
@@            Coverage Diff             @@
##             main     #846      +/-   ##
==========================================
- Coverage   52.47%   52.03%   -0.45%     
==========================================
  Files          42       42              
  Lines        4335     4384      +49     
==========================================
+ Hits         2275     2281       +6     
- Misses       1985     2025      +40     
- Partials       75       78       +3     
```

k8s-ci-robot: @JAORMX: PR needs rebase.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
k8s-ci-robot: @JAORMX: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | e6383240e255934dd84ccb4bb459ed04dbe2cc7f | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-verify/1511724177319530496) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | 959cc76fdc485a178d76b4a484bde0518aa11a56 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-verify/1511727415263498240) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
JAORMX: /retest
k8s-ci-robot: @JAORMX: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | 42076dfaea27299d211ffdb295b00b699c6ef7a6 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-verify/1511729953949880320) | true | `/test pull-security-profiles-operator-verify`
pull-security-profiles-operator-test-unit | 42076dfaea27299d211ffdb295b00b699c6ef7a6 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-unit/1511730452908478464) | true | `/test pull-security-profiles-operator-test-unit`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-unit | 42076dfaea27299d211ffdb295b00b699c6ef7a6 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-unit/1511730452908478464) | true | `/test pull-security-profiles-operator-test-unit`
pull-security-profiles-operator-verify | 42076dfaea27299d211ffdb295b00b699c6ef7a6 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-verify/1511730452874924032) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-e2e | e445ee59a62792d2730b35dba3742a59cf24a979 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-e2e/1511984195197472768) | true | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | ff6080a85ab11b0af658443dea5890fad5e63fa0 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-verify/1512050554191220736) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | 46691f31d2b39112911f6f5390ac65ec82860625 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-verify/1512076440638590976) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | 46691f31d2b39112911f6f5390ac65ec82860625 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-verify/1512076440638590976) | true | `/test pull-security-profiles-operator-verify`
pull-security-profiles-operator-test-unit | 46691f31d2b39112911f6f5390ac65ec82860625 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-unit/1512076440676339712) | true | `/test pull-security-profiles-operator-test-unit`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-unit | 46691f31d2b39112911f6f5390ac65ec82860625 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-unit/1512076440676339712) | true | `/test pull-security-profiles-operator-test-unit`
pull-security-profiles-operator-verify | 46c7558ae3129eac3eeaa5d31ae4ad384425622d | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-verify/1512080077720915968) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | 46c7558ae3129eac3eeaa5d31ae4ad384425622d | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-verify/1512080077720915968) | true | `/test pull-security-profiles-operator-verify`
pull-security-profiles-operator-test-unit | 46c7558ae3129eac3eeaa5d31ae4ad384425622d | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-unit/1512080077762859008) | true | `/test pull-security-profiles-operator-test-unit`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | 46c7558ae3129eac3eeaa5d31ae4ad384425622d | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-verify/1512080077720915968) | true | `/test pull-security-profiles-operator-verify`
pull-security-profiles-operator-test-unit | 46c7558ae3129eac3eeaa5d31ae4ad384425622d | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-unit/1512080077762859008) | true | `/test pull-security-profiles-operator-test-unit`
pull-security-profiles-operator-test-e2e | 46c7558ae3129eac3eeaa5d31ae4ad384425622d | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-e2e/1512080077863522304) | true | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
JAORMX: /retest
k8s-ci-robot: @JAORMX: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-unit | 46c7558ae3129eac3eeaa5d31ae4ad384425622d | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-unit/1512080077762859008) | true | `/test pull-security-profiles-operator-test-unit`
pull-security-profiles-operator-test-e2e | 46c7558ae3129eac3eeaa5d31ae4ad384425622d | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-e2e/1512080077863522304) | true | `/test pull-security-profiles-operator-test-e2e`
pull-security-profiles-operator-verify | 46c7558ae3129eac3eeaa5d31ae4ad384425622d | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-verify/1512317703220629504) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 46c7558ae3129eac3eeaa5d31ae4ad384425622d | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-e2e/1512080077863522304) | true | `/test pull-security-profiles-operator-test-e2e`
pull-security-profiles-operator-test-unit | a34fd046018a270302cc59ec48ff3a3fdcd9081b | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-unit/1512319745968312320) | true | `/test pull-security-profiles-operator-test-unit`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-unit | 9de7e521a60d1dd636f2a58333b953de7d320dfd | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-unit/1512344189642215424) | true | `/test pull-security-profiles-operator-test-unit`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-unit | 706afece5615004fab7b06bd08c23e72c41fd631 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-unit/1512348804571992064) | true | `/test pull-security-profiles-operator-test-unit`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-e2e | d41321fe9c1e076f3aec0c5dd223ad114adf61a0 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-e2e/1512351799560900608) | true | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
JAORMX: /retest
k8s-ci-robot: @JAORMX: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-e2e | d41321fe9c1e076f3aec0c5dd223ad114adf61a0 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/846/pull-security-profiles-operator-test-e2e/1512355524828467200) | true | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=846). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
JAORMX: @jhrozek I'll add some docs about this.

Also, enabling the `labelProblematicPods` flag does not enable the enricher. The enricher needs to be enabled as a pre-requisite.
JAORMX: @saschagrunert thanks for the suggestions! Fixed

Patch:
diff --git a/api/spod/v1alpha1/spod_types.go b/api/spod/v1alpha1/spod_types.go
index cf9b1d85d..12eac7e75 100644
--- a/api/spod/v1alpha1/spod_types.go
+++ b/api/spod/v1alpha1/spod_types.go
@@ -68,6 +68,10 @@ type SPODSpec struct {
 	// tells the operator whether or not to enable AppArmor support for this
 	// SPOD instance.
 	EnableAppArmor bool `json:"enableAppArmor,omitempty"`
+	// tells the operator whether or not to apply labels to pods that present
+	// security policy-related denials. Note that this will be done cluster-wide.
+	// Note that this currently requires the log enricher to be enabled.
+	LabelPodDenials bool `json:"labelPodDenials,omitempty"`
 	// If specified, the SPOD's tolerations.
 	// +optional
 	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`
diff --git a/bundle/manifests/security-profiles-operator.x-k8s.io_securityprofilesoperatordaemons.yaml b/bundle/manifests/security-profiles-operator.x-k8s.io_securityprofilesoperatordaemons.yaml
index f0bc84634..de435a55e 100644
--- a/bundle/manifests/security-profiles-operator.x-k8s.io_securityprofilesoperatordaemons.yaml
+++ b/bundle/manifests/security-profiles-operator.x-k8s.io_securityprofilesoperatordaemons.yaml
@@ -69,6 +69,12 @@ spec:
                   as bpf-recorder to retrieve the container ID for a process ID. This
                   can be helpful for nested environments, for example when using "kind".
                 type: string
+              labelPodDenials:
+                description: tells the operator whether or not to apply labels to
+                  pods that present security policy-related denials. Note that this
+                  will be done cluster-wide. Note that this currently requires the
+                  log enricher to be enabled.
+                type: boolean
               selinuxOptions:
                 description: Defines options specific to the SELinux functionality
                   of the SecurityProfilesOperator
diff --git a/bundle/manifests/spod_rbac.authorization.k8s.io_v1_clusterrole.yaml b/bundle/manifests/spod_rbac.authorization.k8s.io_v1_clusterrole.yaml
index d245308d2..99f6593f0 100644
--- a/bundle/manifests/spod_rbac.authorization.k8s.io_v1_clusterrole.yaml
+++ b/bundle/manifests/spod_rbac.authorization.k8s.io_v1_clusterrole.yaml
@@ -49,6 +49,8 @@ rules:
   verbs:
   - get
   - list
+  - patch
+  - update
   - watch
 - apiGroups:
   - security-profiles-operator.x-k8s.io
diff --git a/cmd/security-profiles-operator/main.go b/cmd/security-profiles-operator/main.go
index 40c15d202..fbdc3cd12 100644
--- a/cmd/security-profiles-operator/main.go
+++ b/cmd/security-profiles-operator/main.go
@@ -66,6 +66,7 @@ const (
 	jsonFlag           string = "json"
 	selinuxFlag        string = "with-selinux"
 	apparmorFlag       string = "with-apparmor"
+	labelDenialsFlag   string = "label-denials"
 	defaultWebhookPort int    = 9443
 )
 
@@ -172,6 +173,13 @@ func main() {
 			Name:    "log-enricher",
 			Aliases: []string{"l"},
 			Usage:   "run the audit's log enricher",
+			Flags: []cli.Flag{
+				&cli.BoolFlag{
+					Name:  labelDenialsFlag,
+					Usage: "whether to label problematic pods or not",
+					Value: false,
+				},
+			},
 			Action: func(ctx *cli.Context) error {
 				return runLogEnricher(ctx, info)
 			},
@@ -435,10 +443,15 @@ func runBPFRecorder(_ *cli.Context, info *version.Info) error {
 	return bpfrecorder.New(ctrl.Log.WithName(component)).Run()
 }
 
-func runLogEnricher(_ *cli.Context, info *version.Info) error {
+func runLogEnricher(clictx *cli.Context, info *version.Info) error {
 	const component = "log-enricher"
 	printInfo(component, info)
-	return enricher.New(ctrl.Log.WithName(component)).Run()
+
+	e, err := enricher.New(ctrl.Log.WithName(component), clictx.Bool(labelDenialsFlag))
+	if err != nil {
+		return fmt.Errorf("building log enricher: %w", err)
+	}
+	return e.Run()
 }
 
 func runNonRootEnabler(_ *cli.Context, info *version.Info) error {
diff --git a/deploy/base/crds/securityprofilesoperatordaemon.yaml b/deploy/base/crds/securityprofilesoperatordaemon.yaml
index c7e76ec99..0df06b7ae 100644
--- a/deploy/base/crds/securityprofilesoperatordaemon.yaml
+++ b/deploy/base/crds/securityprofilesoperatordaemon.yaml
@@ -67,6 +67,12 @@ spec:
                   as bpf-recorder to retrieve the container ID for a process ID. This
                   can be helpful for nested environments, for example when using "kind".
                 type: string
+              labelPodDenials:
+                description: tells the operator whether or not to apply labels to
+                  pods that present security policy-related denials. Note that this
+                  will be done cluster-wide. Note that this currently requires the
+                  log enricher to be enabled.
+                type: boolean
               selinuxOptions:
                 description: Defines options specific to the SELinux functionality
                   of the SecurityProfilesOperator
diff --git a/deploy/base/role.yaml b/deploy/base/role.yaml
index 5e966fd7b..b86788820 100644
--- a/deploy/base/role.yaml
+++ b/deploy/base/role.yaml
@@ -299,6 +299,8 @@ rules:
   verbs:
   - get
   - list
+  - patch
+  - update
   - watch
 - apiGroups:
   - security-profiles-operator.x-k8s.io
diff --git a/deploy/namespace-operator.yaml b/deploy/namespace-operator.yaml
index 7b7e42169..160dbaf41 100644
--- a/deploy/namespace-operator.yaml
+++ b/deploy/namespace-operator.yaml
@@ -609,6 +609,12 @@ spec:
                   as bpf-recorder to retrieve the container ID for a process ID. This
                   can be helpful for nested environments, for example when using "kind".
                 type: string
+              labelPodDenials:
+                description: tells the operator whether or not to apply labels to
+                  pods that present security policy-related denials. Note that this
+                  will be done cluster-wide. Note that this currently requires the
+                  log enricher to be enabled.
+                type: boolean
               selinuxOptions:
                 description: Defines options specific to the SELinux functionality
                   of the SecurityProfilesOperator
@@ -1434,6 +1440,8 @@ rules:
   verbs:
   - get
   - list
+  - patch
+  - update
   - watch
 - apiGroups:
   - security-profiles-operator.x-k8s.io
diff --git a/deploy/openshift-dev.yaml b/deploy/openshift-dev.yaml
index 45e6010bf..e78514cec 100644
--- a/deploy/openshift-dev.yaml
+++ b/deploy/openshift-dev.yaml
@@ -609,6 +609,12 @@ spec:
                   as bpf-recorder to retrieve the container ID for a process ID. This
                   can be helpful for nested environments, for example when using "kind".
                 type: string
+              labelPodDenials:
+                description: tells the operator whether or not to apply labels to
+                  pods that present security policy-related denials. Note that this
+                  will be done cluster-wide. Note that this currently requires the
+                  log enricher to be enabled.
+                type: boolean
               selinuxOptions:
                 description: Defines options specific to the SELinux functionality
                   of the SecurityProfilesOperator
@@ -1434,6 +1440,8 @@ rules:
   verbs:
   - get
   - list
+  - patch
+  - update
   - watch
 - apiGroups:
   - security-profiles-operator.x-k8s.io
diff --git a/deploy/operator.yaml b/deploy/operator.yaml
index 02bfcab75..c63ad8814 100644
--- a/deploy/operator.yaml
+++ b/deploy/operator.yaml
@@ -609,6 +609,12 @@ spec:
                   as bpf-recorder to retrieve the container ID for a process ID. This
                   can be helpful for nested environments, for example when using "kind".
                 type: string
+              labelPodDenials:
+                description: tells the operator whether or not to apply labels to
+                  pods that present security policy-related denials. Note that this
+                  will be done cluster-wide. Note that this currently requires the
+                  log enricher to be enabled.
+                type: boolean
               selinuxOptions:
                 description: Defines options specific to the SELinux functionality
                   of the SecurityProfilesOperator
@@ -1434,6 +1440,8 @@ rules:
   verbs:
   - get
   - list
+  - patch
+  - update
   - watch
 - apiGroups:
   - security-profiles-operator.x-k8s.io
diff --git a/go.mod b/go.mod
index 1e517922b..0899489cd 100644
--- a/go.mod
+++ b/go.mod
@@ -20,6 +20,8 @@ require (
 	github.com/seccomp/libseccomp-golang v0.9.2-0.20210429002308-3879420cc921
 	github.com/stretchr/testify v1.7.1
 	github.com/urfave/cli/v2 v2.4.0
+	golang.org/x/net v0.0.0-20220225172249-27dd8689420f
+	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c
 	google.golang.org/grpc v1.45.0
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.2.0
 	google.golang.org/protobuf v1.28.0
@@ -94,9 +96,7 @@ require (
 	github.com/xanzy/ssh-agent v0.3.1 // indirect
 	golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3 // indirect
 	golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3 // indirect
-	golang.org/x/net v0.0.0-20220225172249-27dd8689420f // indirect
 	golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8 // indirect
-	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c // indirect
 	golang.org/x/sys v0.0.0-20220315194320-039c03cc5b86 // indirect
 	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 // indirect
 	golang.org/x/text v0.3.7 // indirect
diff --git a/installation-usage.md b/installation-usage.md
index 542c8a2b3..3f5f7d32a 100644
--- a/installation-usage.md
+++ b/installation-usage.md
@@ -120,7 +120,7 @@ securityprofilesoperatordaemon.security-profiles-operator.x-k8s.io/spod patched
 The daemon should now indicate that it's using the new logging verbosity:
 
 ```
-> k logs ds/spod security-profiles-operator | head -n1
+> k logs --selector name=spod security-profiles-operator | head -n1
 I1111 15:13:16.942837       1 main.go:182]  "msg"="Set logging verbosity to 1"
 ```
 
@@ -306,9 +306,9 @@ $ kubectl get pod test-pod -o jsonpath='{.spec.containers[*].securityContext.sec
 ### Record profiles from workloads with `ProfileRecordings`
 
 The operator is capable of recording seccomp profiles by the usage of the
-[oci-seccomp-bpf-hook][bpf-hook] or by evaluating the [audit][auditd] or
-[syslog][syslog] files. Both methods have its pros and cons as well as separate
-technical requirements.
+built-in [eBPF](https://ebpf.io) recorder, [oci-seccomp-bpf-hook][bpf-hook] or
+by evaluating the [audit][auditd] or [syslog][syslog] files. Each method has
+its pros and cons as well as separate technical requirements.
 
 #### Hook based recording
 
@@ -326,6 +326,10 @@ hooks_dir = [
 ]
 ```
 
+The `seccomp-hook` has to be installed as well. The package name differs on
+each Linux distributions, for example of Fedora/RHEL, the package is named
+`oci-seccomp-bpf-hook`
+
 The hook references a [path][path] to the actual binary which gets executed on
 `prestart`. Please note that at least CRI-O v1.21.0 is required to let the hook
 and CRI-O work nicely together.
@@ -551,7 +555,7 @@ my-pod   2/2     Running   0          18s
 Then the enricher should indicate that it receives audit logs for those containers:
 
 ```
-> kubectl -n security-profiles-operator logs --since=1m ds/spod log-enricher
+> kubectl -n security-profiles-operator logs --since=1m --selector name=spod log-enricher
 …
 I0705 12:08:18.729660 1843190 enricher.go:136] log-enricher "msg"="audit"  "container"="redis" "executable"="/usr/local/bin/redis-server" "namespace"="default" "node"="127.0.0.1" "pid"=1847839 "pod"="my-pod" "syscallID"=232 "syscallName"="epoll_wait" "timestamp"="1625486870.273:187492" "type"="seccomp"
 ```
@@ -576,7 +580,16 @@ test-recording-redis   Installed   15s
 The operator also supports an [eBPF](https://ebpf.io) based recorder. This
 recorder only supports seccomp profiles for now. Recording via ebpf works for
 kernels which expose the `/sys/kernel/btf/vmlinux` file per default as well as a
-[custom list of selected Linux kernels](bpf-support.md).
+[custom list of selected Linux kernels](bpf-support.md). In addition, this
+feature requires new library versions and thus might not be enabled. You
+can find out if your SPO build has the eBPF feature disabled by looking at
+the build tags:
+
+```
+> kubectl logs --selector name=security-profiles-operator | grep buildTags
+```
+
+If the output contains `no_bpf` then the feature has been disabled.
 
 To use the recorder, enable it by patching the `spod` configuration:
 
@@ -589,7 +602,7 @@ We can verify that the recorder is up and running after the spod rollout has
 been finished:
 
 ```
-> kubectl logs ds/spod -c bpf-recorder
+> kubectl -n security-profiles-operator logs --selector name=spod -c bpf-recorder
 Found 6 pods, using pod/spod-h7dpm
 I1115 12:02:45.991786  110307 main.go:182]  "msg"="Set logging verbosity to 0"
 I1115 12:02:45.991901  110307 deleg.go:130] setup "msg"="starting component: bpf-recorder"  "buildDate"="1980-01-01T00:00:00Z" "compiler"="gc" "gitCommit"="unknown" "gitTreeState"="clean" "goVersion"="go1.16.9" "libseccomp"="2.5.1" "platform"="linux/amd64" "version"="0.4.0-dev"
@@ -656,7 +669,7 @@ my-pod   1/1     Running   0          10s
 Then the BPF recorder should indicate that it found the container:
 
 ```
-> kubectl -n security-profiles-operator logs --since=1m ds/spod log-enricher
+> kubectl -n security-profiles-operator logs --since=1m --selector name=spod -c log-enricher
 …
 I1115 12:12:30.029216   66106 bpfrecorder.go:654] bpf-recorder "msg"="Found container ID in cluster"  "containerID"="c2e10af47011f6a61cd7e92073db2711796f174af35b34486967588ef7f95fbc" "containerName"="nginx"
 I1115 12:12:30.029264   66106 bpfrecorder.go:539] bpf-recorder "msg"="Saving PID for profile"  "mntns"=4026533352 "pid"=74384 "profile"="my-recording-nginx-1636978341"
@@ -1059,13 +1072,13 @@ The containers of the daemon should now indicate that it's serving the profiling
 endpoint, where every container is using a different port:
 
 ```
-> k logs ds/spod -c security-profiles-operator | grep "Starting profiling"
+> k logs --selector name=spod -c security-profiles-operator | grep "Starting profiling"
 I1202 15:14:40.276363 2185724 main.go:226]  "msg"="Starting profiling server"  "endpoint"="localhost:6060"
 
-> k logs ds/spod -c log-enricher | grep "Starting profiling"
+> k logs --selector name=spod -c log-enricher | grep "Starting profiling"
 I1202 15:14:40.364046 2185814 main.go:226]  "msg"="Starting profiling server"  "endpoint"="localhost:6061"
 
-> k logs ds/spod -c bpf-recorder | grep "Starting profiling"
+> k logs --selector name=spod -c bpf-recorder | grep "Starting profiling"
 I1202 15:14:40.457506 2185914 main.go:226]  "msg"="Starting profiling server"  "endpoint"="localhost:6062"
 ```
 
diff --git a/internal/pkg/daemon/enricher/container.go b/internal/pkg/daemon/enricher/container.go
index f2d7128e0..82f543384 100644
--- a/internal/pkg/daemon/enricher/container.go
+++ b/internal/pkg/daemon/enricher/container.go
@@ -22,6 +22,11 @@ import (
 	"time"
 
 	"github.com/ReneKroon/ttlcache/v2"
+	"github.com/go-logr/logr"
+	"golang.org/x/net/context"
+	"golang.org/x/sync/errgroup"
+	v1 "k8s.io/api/core/v1"
+	kerrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/util/wait"
 
 	"sigs.k8s.io/security-profiles-operator/internal/pkg/config"
@@ -29,22 +34,28 @@ import (
 )
 
 const (
-	backoffDuration = 500 * time.Millisecond
-	backoffFactor   = 1.5
-	backoffSteps    = 10
+	// timeout for operations... The number was chosen randomly.
+	operationTimeout = 10 * time.Second
+	backoffDuration  = 500 * time.Millisecond
+	backoffFactor    = 1.5
+	backoffSteps     = 10
+
+	problematicContainerLabelKey = "spo.x-k8s.io/had-denials"
 )
 
+var errContainerIDEmpty = errors.New("container ID is empty")
+
 // NOTE(jaosorior): Should this actually be namespace-scoped?
 //
 // Cluster scoped
-// +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list;watch;
+// +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list;watch;patch;update
 
 func (e *Enricher) getContainerInfo(
-	nodeName, containerID string,
+	nodeName, targetContainerID string,
 ) (*containerInfo, error) {
 	// Check the cache first
 	if info, err := e.infoCache.Get(
-		containerID,
+		targetContainerID,
 	); !errors.Is(err, ttlcache.ErrNotFound) {
 		cInfo, ok := info.(*containerInfo)
 		if !ok {
@@ -53,102 +64,170 @@ func (e *Enricher) getContainerInfo(
 		return cInfo, nil
 	}
 
-	clusterConfig, err := e.impl.InClusterConfig()
-	if err != nil {
-		return nil, fmt.Errorf("get in-cluster config: %w", err)
+	if err := e.populateContainerPodCache(nodeName, targetContainerID); err != nil {
+		return nil, fmt.Errorf("get container info for pods: %w", err)
 	}
 
-	clientset, err := e.impl.NewForConfig(clusterConfig)
-	if err != nil {
-		return nil, fmt.Errorf("load in-cluster config: %w", err)
+	if info, err := e.infoCache.Get(
+		targetContainerID,
+	); !errors.Is(err, ttlcache.ErrNotFound) {
+		cInfo, ok := info.(*containerInfo)
+		if !ok {
+			return nil, errors.New("cache value is not container info")
+		}
+		return cInfo, nil
 	}
 
+	return nil, errors.New("no container info for container ID")
+}
+
+func (e *Enricher) populateContainerPodCache(
+	nodeName, targetContainerID string,
+) error {
 	containerRetryBackoff := wait.Backoff{
 		Duration: backoffDuration,
 		Factor:   backoffFactor,
 		Steps:    backoffSteps,
 	}
 
-	errContainerIDEmpty := errors.New("container ID is empty")
-	if err := util.RetryEx(
+	ctxwithTimeout, cancel := context.WithTimeout(context.Background(), operationTimeout)
+	defer cancel()
+
+	return util.RetryEx(
 		&containerRetryBackoff,
 		func() (retryErr error) {
-			pods, err := e.impl.ListPods(clientset, nodeName)
+			pods, err := e.impl.ListPods(ctxwithTimeout, e.clientset, nodeName)
 			if err != nil {
 				return fmt.Errorf("list node %s's pods: %w", nodeName, err)
 			}
 
+			eg, ctx := errgroup.WithContext(ctxwithTimeout)
+
 			for p := range pods.Items {
 				pod := &pods.Items[p]
+				e.populateCacheEntryForContainer(ctx, targetContainerID, pod, eg)
+			}
 
-				for c := range pod.Status.ContainerStatuses {
-					containerStatus := pod.Status.ContainerStatuses[c]
-					containerID := containerStatus.ContainerID
-					containerName := containerStatus.Name
-
-					if containerID == "" {
-						if containerStatus.State.Waiting != nil &&
-							containerStatus.State.Waiting.Reason == "ContainerCreating" {
-							e.logger.Info(
-								"container ID is still empty, retrying",
-								"podName", pod.Name,
-								"containerName", containerName,
-							)
-							return errContainerIDEmpty
-						}
-
-						return fmt.Errorf(
-							"container ID not found with container state: %v",
-							containerStatus.State,
-						)
-					}
-
-					rawContainerID := util.ContainerIDRegex.FindString(containerID)
-					if rawContainerID == "" {
-						e.logger.Error(
-							err, "unable to get container ID",
-							"podName", pod.Name,
-							"containerName", containerName,
-						)
-						continue
-					}
-
-					recordProfile, ok := pod.Annotations[config.SeccompProfileRecordLogsAnnotationKey+containerName]
-					if !ok {
-						recordProfile = pod.Annotations[config.SelinuxProfileRecordLogsAnnotationKey+containerName]
-					}
-					info := &containerInfo{
-						podName:       pod.Name,
-						containerName: containerStatus.Name,
-						namespace:     pod.Namespace,
-						containerID:   rawContainerID,
-						recordProfile: recordProfile,
-					}
-
-					// Update the cache
-					if err := e.infoCache.Set(rawContainerID, info); err != nil {
-						return fmt.Errorf("update cache: %w", err)
-					}
-				}
+			if werr := eg.Wait(); werr != nil {
+				return werr
 			}
+
 			return nil
 		},
 		func(inErr error) bool {
 			return errors.Is(inErr, errContainerIDEmpty)
 		},
-	); err != nil {
-		return nil, fmt.Errorf("get container info for pods: %w", err)
+	)
+}
+
+func (e *Enricher) populateCacheEntryForContainer(
+	ctx context.Context, targetContainerID string, pod *v1.Pod, eg *errgroup.Group,
+) {
+	eg.Go(func() (errorToRetry error) {
+		// nolint:gocritic // This is what we expect and want
+		statuses := append(pod.Status.InitContainerStatuses, pod.Status.ContainerStatuses...)
+
+		for c := range statuses {
+			containerStatus := statuses[c]
+			containerID := containerStatus.ContainerID
+			containerName := containerStatus.Name
+
+			if containerID == "" {
+				// This just means the container is still being created
+				// We can come back to this later
+				idemptyErr := e.handleContainerIDEmpty(pod.Name, containerName, &containerStatus)
+				if errors.Is(idemptyErr, errContainerIDEmpty) {
+					errorToRetry = idemptyErr
+					continue
+				}
+				return idemptyErr
+			}
+
+			rawContainerID := util.ContainerIDRegex.FindString(containerID)
+			if rawContainerID == "" {
+				e.logger.Info(
+					"unable to get container ID",
+					"podName", pod.Name,
+					"containerName", containerName,
+				)
+				continue
+			}
+
+			recordProfile, ok := pod.Annotations[config.SeccompProfileRecordLogsAnnotationKey+containerName]
+			if !ok {
+				recordProfile = pod.Annotations[config.SelinuxProfileRecordLogsAnnotationKey+containerName]
+			}
+			info := &containerInfo{
+				podName:       pod.Name,
+				containerName: containerStatus.Name,
+				namespace:     pod.Namespace,
+				containerID:   rawContainerID,
+				recordProfile: recordProfile,
+			}
+
+			if e.labelDenials && rawContainerID == targetContainerID {
+				e.logger.Info("labeling problematic container", "containerID", containerID,
+					"podNamespace", pod.Namespace, "podName", pod.Name)
+				e.labelPodDenials(ctx, info.containerName, pod.DeepCopy(), e.logger)
+			}
+
+			// Update the cache
+			if err := e.infoCache.Set(rawContainerID, info); err != nil {
+				return fmt.Errorf("update cache: %w", err)
+			}
+		}
+
+		return errorToRetry
+	})
+}
+
+func (e *Enricher) handleContainerIDEmpty(podName, containerName string, containerStatus *v1.ContainerStatus) error {
+	if containerStatus.State.Waiting != nil &&
+		(containerStatus.State.Waiting.Reason == "ContainerCreating" ||
+			containerStatus.State.Waiting.Reason == "PodInitializing") {
+		e.logger.Info(
+			"container ID is still empty, retrying",
+			"podName", podName,
+			"containerName", containerName,
+		)
+		return errContainerIDEmpty
 	}
 
-	if info, err := e.infoCache.Get(
-		containerID,
-	); !errors.Is(err, ttlcache.ErrNotFound) {
-		cInfo, ok := info.(*containerInfo)
-		if !ok {
-			return nil, errors.New("cache value is not container info")
+	return fmt.Errorf(
+		"container ID not found with container state: %v",
+		containerStatus.State,
+	)
+}
+
+func (e *Enricher) labelPodDenials(
+	ctx context.Context, containerName string, pod *v1.Pod, l logr.Logger,
+) {
+	// verify if we need to label or if the label is already there
+	if labels := pod.GetLabels(); labels != nil {
+		if _, ok := labels[problematicContainerLabelKey]; ok {
+			return
 		}
-		return cInfo, nil
 	}
 
-	return nil, errors.New("no container info for container ID")
+	containerRetryBackoff := wait.Backoff{
+		Duration: backoffDuration,
+		Factor:   backoffFactor,
+		Steps:    backoffSteps,
+	}
+
+	if err := util.RetryEx(
+		&containerRetryBackoff,
+		func() (retryErr error) {
+			return e.impl.LabelPodDenials(ctx, e.clientset, pod)
+		},
+		func(inErr error) bool {
+			return !kerrors.IsNotFound(inErr)
+		},
+	); err != nil {
+		l.Error(
+			err, "unable to patch container to mark it as problematic",
+			"pod.Namespace", pod.GetNamespace(), "pod.Name", pod.GetName(),
+			"containerName", containerName,
+		)
+	}
 }
diff --git a/internal/pkg/daemon/enricher/enricher.go b/internal/pkg/daemon/enricher/enricher.go
index 6b4edfb97..26523d28a 100644
--- a/internal/pkg/daemon/enricher/enricher.go
+++ b/internal/pkg/daemon/enricher/enricher.go
@@ -32,6 +32,7 @@ import (
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/protobuf/encoding/protojson"
 	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/client-go/kubernetes"
 	rutil "sigs.k8s.io/release-utils/util"
 
 	apienricher "sigs.k8s.io/security-profiles-operator/api/grpc/enricher"
@@ -61,24 +62,48 @@ type Enricher struct {
 	syscalls         sync.Map
 	avcs             sync.Map
 	auditLineCache   *ttlcache.Cache
+	clientset        kubernetes.Interface
+	labelDenials     bool
 }
 
 // New returns a new Enricher instance.
-func New(logger logr.Logger) *Enricher {
+func New(logger logr.Logger, labelDenials bool, impls ...impl) (*Enricher, error) {
+	var effectiveimpl impl
+	if len(impls) == 0 {
+		effectiveimpl = &defaultImpl{}
+	} else {
+		effectiveimpl = impls[0]
+	}
+	clusterConfig, err := effectiveimpl.InClusterConfig()
+	if err != nil {
+		return nil, fmt.Errorf("get in-cluster config: %w", err)
+	}
+
+	clientset, err := effectiveimpl.NewForConfig(clusterConfig)
+	if err != nil {
+		return nil, fmt.Errorf("load in-cluster config: %w", err)
+	}
+
 	return &Enricher{
-		impl:             &defaultImpl{},
+		impl:             effectiveimpl,
 		logger:           logger,
 		containerIDCache: ttlcache.NewCache(),
 		infoCache:        ttlcache.NewCache(),
 		syscalls:         sync.Map{},
 		avcs:             sync.Map{},
 		auditLineCache:   ttlcache.NewCache(),
-	}
+		labelDenials:     labelDenials,
+		clientset:        clientset,
+	}, nil
 }
 
 // Run the log-enricher to scrap audit logs and enrich them with
 // Kubernetes data (namespace, pod and container).
 func (e *Enricher) Run() error {
+	if e.labelDenials {
+		e.logger.Info("Labeling problematic containers is enabled")
+	}
+
 	e.logger.Info(fmt.Sprintf("Setting up caches with expiry of %v", defaultCacheTimeout))
 	for _, cache := range []*ttlcache.Cache{
 		e.containerIDCache,
diff --git a/internal/pkg/daemon/enricher/enricherfakes/fake_impl.go b/internal/pkg/daemon/enricher/enricherfakes/fake_impl.go
index 4fe46fb81..61953b488 100644
--- a/internal/pkg/daemon/enricher/enricherfakes/fake_impl.go
+++ b/internal/pkg/daemon/enricher/enricherfakes/fake_impl.go
@@ -161,6 +161,19 @@ type FakeImpl struct {
 		result1 *rest.Config
 		result2 error
 	}
+	LabelPodDenialsStub        func(context.Context, kubernetes.Interface, *v1.Pod) error
+	labelPodDenialsMutex       sync.RWMutex
+	labelPodDenialsArgsForCall []struct {
+		arg1 context.Context
+		arg2 kubernetes.Interface
+		arg3 *v1.Pod
+	}
+	labelPodDenialsReturns struct {
+		result1 error
+	}
+	labelPodDenialsReturnsOnCall map[int]struct {
+		result1 error
+	}
 	LinesStub        func(*tail.Tail) chan *tail.Line
 	linesMutex       sync.RWMutex
 	linesArgsForCall []struct {
@@ -172,11 +185,12 @@ type FakeImpl struct {
 	linesReturnsOnCall map[int]struct {
 		result1 chan *tail.Line
 	}
-	ListPodsStub        func(*kubernetes.Clientset, string) (*v1.PodList, error)
+	ListPodsStub        func(context.Context, kubernetes.Interface, string) (*v1.PodList, error)
 	listPodsMutex       sync.RWMutex
 	listPodsArgsForCall []struct {
-		arg1 *kubernetes.Clientset
-		arg2 string
+		arg1 context.Context
+		arg2 kubernetes.Interface
+		arg3 string
 	}
 	listPodsReturns struct {
 		result1 *v1.PodList
@@ -921,6 +935,69 @@ func (fake *FakeImpl) InClusterConfigReturnsOnCall(i int, result1 *rest.Config,
 	}{result1, result2}
 }
 
+func (fake *FakeImpl) LabelPodDenials(arg1 context.Context, arg2 kubernetes.Interface, arg3 *v1.Pod) error {
+	fake.labelPodDenialsMutex.Lock()
+	ret, specificReturn := fake.labelPodDenialsReturnsOnCall[len(fake.labelPodDenialsArgsForCall)]
+	fake.labelPodDenialsArgsForCall = append(fake.labelPodDenialsArgsForCall, struct {
+		arg1 context.Context
+		arg2 kubernetes.Interface
+		arg3 *v1.Pod
+	}{arg1, arg2, arg3})
+	stub := fake.LabelPodDenialsStub
+	fakeReturns := fake.labelPodDenialsReturns
+	fake.recordInvocation("LabelPodDenials", []interface{}{arg1, arg2, arg3})
+	fake.labelPodDenialsMutex.Unlock()
+	if stub != nil {
+		return stub(arg1, arg2, arg3)
+	}
+	if specificReturn {
+		return ret.result1
+	}
+	return fakeReturns.result1
+}
+
+func (fake *FakeImpl) LabelPodDenialsCallCount() int {
+	fake.labelPodDenialsMutex.RLock()
+	defer fake.labelPodDenialsMutex.RUnlock()
+	return len(fake.labelPodDenialsArgsForCall)
+}
+
+func (fake *FakeImpl) LabelPodDenialsCalls(stub func(context.Context, kubernetes.Interface, *v1.Pod) error) {
+	fake.labelPodDenialsMutex.Lock()
+	defer fake.labelPodDenialsMutex.Unlock()
+	fake.LabelPodDenialsStub = stub
+}
+
+func (fake *FakeImpl) LabelPodDenialsArgsForCall(i int) (context.Context, kubernetes.Interface, *v1.Pod) {
+	fake.labelPodDenialsMutex.RLock()
+	defer fake.labelPodDenialsMutex.RUnlock()
+	argsForCall := fake.labelPodDenialsArgsForCall[i]
+	return argsForCall.arg1, argsForCall.arg2, argsForCall.arg3
+}
+
+func (fake *FakeImpl) LabelPodDenialsReturns(result1 error) {
+	fake.labelPodDenialsMutex.Lock()
+	defer fake.labelPodDenialsMutex.Unlock()
+	fake.LabelPodDenialsStub = nil
+	fake.labelPodDenialsReturns = struct {
+		result1 error
+	}{result1}
+}
+
+func (fake *FakeImpl) LabelPodDenialsReturnsOnCall(i int, result1 error) {
+	fake.labelPodDenialsMutex.Lock()
+	defer fake.labelPodDenialsMutex.Unlock()
+	fake.LabelPodDenialsStub = nil
+	if fake.labelPodDenialsReturnsOnCall == nil {
+		fake.labelPodDenialsReturnsOnCall = make(map[int]struct {
+			result1 error
+		})
+	}
+	fake.labelPodDenialsReturnsOnCall[i] = struct {
+		result1 error
+	}{result1}
+}
+
 func (fake *FakeImpl) Lines(arg1 *tail.Tail) chan *tail.Line {
 	fake.linesMutex.Lock()
 	ret, specificReturn := fake.linesReturnsOnCall[len(fake.linesArgsForCall)]
@@ -982,19 +1059,20 @@ func (fake *FakeImpl) LinesReturnsOnCall(i int, result1 chan *tail.Line) {
 	}{result1}
 }
 
-func (fake *FakeImpl) ListPods(arg1 *kubernetes.Clientset, arg2 string) (*v1.PodList, error) {
+func (fake *FakeImpl) ListPods(arg1 context.Context, arg2 kubernetes.Interface, arg3 string) (*v1.PodList, error) {
 	fake.listPodsMutex.Lock()
 	ret, specificReturn := fake.listPodsReturnsOnCall[len(fake.listPodsArgsForCall)]
 	fake.listPodsArgsForCall = append(fake.listPodsArgsForCall, struct {
-		arg1 *kubernetes.Clientset
-		arg2 string
-	}{arg1, arg2})
+		arg1 context.Context
+		arg2 kubernetes.Interface
+		arg3 string
+	}{arg1, arg2, arg3})
 	stub := fake.ListPodsStub
 	fakeReturns := fake.listPodsReturns
-	fake.recordInvocation("ListPods", []interface{}{arg1, arg2})
+	fake.recordInvocation("ListPods", []interface{}{arg1, arg2, arg3})
 	fake.listPodsMutex.Unlock()
 	if stub != nil {
-		return stub(arg1, arg2)
+		return stub(arg1, arg2, arg3)
 	}
 	if specificReturn {
 		return ret.result1, ret.result2
@@ -1008,17 +1086,17 @@ func (fake *FakeImpl) ListPodsCallCount() int {
 	return len(fake.listPodsArgsForCall)
 }
 
-func (fake *FakeImpl) ListPodsCalls(stub func(*kubernetes.Clientset, string) (*v1.PodList, error)) {
+func (fake *FakeImpl) ListPodsCalls(stub func(context.Context, kubernetes.Interface, string) (*v1.PodList, error)) {
 	fake.listPodsMutex.Lock()
 	defer fake.listPodsMutex.Unlock()
 	fake.ListPodsStub = stub
 }
 
-func (fake *FakeImpl) ListPodsArgsForCall(i int) (*kubernetes.Clientset, string) {
+func (fake *FakeImpl) ListPodsArgsForCall(i int) (context.Context, kubernetes.Interface, string) {
 	fake.listPodsMutex.RLock()
 	defer fake.listPodsMutex.RUnlock()
 	argsForCall := fake.listPodsArgsForCall[i]
-	return argsForCall.arg1, argsForCall.arg2
+	return argsForCall.arg1, argsForCall.arg2, argsForCall.arg3
 }
 
 func (fake *FakeImpl) ListPodsReturns(result1 *v1.PodList, result2 error) {
@@ -1636,6 +1714,8 @@ func (fake *FakeImpl) Invocations() map[string][][]interface{} {
 	defer fake.getenvMutex.RUnlock()
 	fake.inClusterConfigMutex.RLock()
 	defer fake.inClusterConfigMutex.RUnlock()
+	fake.labelPodDenialsMutex.RLock()
+	defer fake.labelPodDenialsMutex.RUnlock()
 	fake.linesMutex.RLock()
 	defer fake.linesMutex.RUnlock()
 	fake.listPodsMutex.RLock()
diff --git a/internal/pkg/daemon/enricher/impl.go b/internal/pkg/daemon/enricher/impl.go
index fb8ce4ce3..9478b89c0 100644
--- a/internal/pkg/daemon/enricher/impl.go
+++ b/internal/pkg/daemon/enricher/impl.go
@@ -50,7 +50,8 @@ type impl interface {
 	ContainerIDForPID(cache *ttlcache.Cache, pid int) (string, error)
 	InClusterConfig() (*rest.Config, error)
 	NewForConfig(c *rest.Config) (*kubernetes.Clientset, error)
-	ListPods(c *kubernetes.Clientset, nodeName string) (*v1.PodList, error)
+	ListPods(ctx context.Context, c kubernetes.Interface, nodeName string) (*v1.PodList, error)
+	LabelPodDenials(ctx context.Context, c kubernetes.Interface, pod *v1.Pod) error
 	AuditInc(client api.MetricsClient) (api.Metrics_AuditIncClient, error)
 	SendMetric(client api.Metrics_AuditIncClient, in *api.AuditRequest) error
 	Listen(string, string) (net.Listener, error)
@@ -108,13 +109,28 @@ func (d *defaultImpl) NewForConfig(
 }
 
 func (d *defaultImpl) ListPods(
-	c *kubernetes.Clientset, nodeName string,
+	ctx context.Context, c kubernetes.Interface, nodeName string,
 ) (*v1.PodList, error) {
-	return c.CoreV1().Pods("").List(context.TODO(), metav1.ListOptions{
+	return c.CoreV1().Pods("").List(ctx, metav1.ListOptions{
 		FieldSelector: "spec.nodeName=" + nodeName,
 	})
 }
 
+func (d *defaultImpl) LabelPodDenials(
+	ctx context.Context, c kubernetes.Interface, pod *v1.Pod,
+) error {
+	labels := pod.GetLabels()
+	if labels == nil {
+		labels = make(map[string]string)
+	}
+	labels[problematicContainerLabelKey] = ""
+	pod.SetLabels(labels)
+	_, err := c.CoreV1().Pods(pod.GetNamespace()).Update(
+		ctx, pod, metav1.UpdateOptions{},
+	)
+	return err
+}
+
 func (d *defaultImpl) AuditInc(
 	client api.MetricsClient,
 ) (api.Metrics_AuditIncClient, error) {
diff --git a/internal/pkg/daemon/profilerecorder/profilerecorder.go b/internal/pkg/daemon/profilerecorder/profilerecorder.go
index adcfd117c..b41435690 100644
--- a/internal/pkg/daemon/profilerecorder/profilerecorder.go
+++ b/internal/pkg/daemon/profilerecorder/profilerecorder.go
@@ -653,7 +653,7 @@ func (r *RecorderReconciler) collectBpfProfiles(
 			// which is not longer active. Let's skip here and keep processing the
 			// next profile.
 			if status.Convert(err).Message() == bpfrecorder.ErrNotFound.Error() {
-				r.log.Error(err, "Recorded profile not found", profile.name)
+				r.log.Error(err, "Recorded profile not found", "name", profile.name)
 				continue
 			} else {
 				return fmt.Errorf("get syscalls for profile: %w", err)
diff --git a/internal/pkg/manager/spod/bindata/webhook.go b/internal/pkg/manager/spod/bindata/webhook.go
index be6cafde7..0565f9932 100644
--- a/internal/pkg/manager/spod/bindata/webhook.go
+++ b/internal/pkg/manager/spod/bindata/webhook.go
@@ -123,9 +123,13 @@ func GetWebhook(
 	image string,
 	pullPolicy corev1.PullPolicy,
 	caInjectType CAInjectType,
+	tolerations []corev1.Toleration,
 ) *Webhook {
 	deployment := webhookDeployment.DeepCopy()
 	deployment.Namespace = namespace
+	if len(tolerations) > 0 {
+		deployment.Spec.Template.Spec.Tolerations = tolerations
+	}
 
 	ctr := &deployment.Spec.Template.Spec.Containers[0]
 	ctr.Image = image
diff --git a/internal/pkg/manager/spod/spod_controller.go b/internal/pkg/manager/spod/spod_controller.go
index 1178722af..bc4fae026 100644
--- a/internal/pkg/manager/spod/spod_controller.go
+++ b/internal/pkg/manager/spod/spod_controller.go
@@ -157,7 +157,8 @@ func (r *ReconcileSPOd) Reconcile(_ context.Context, req reconcile.Request) (rec
 	}
 	configuredSPOd := r.getConfiguredSPOd(spod, image, pullPolicy, caInjectType)
 
-	webhook := bindata.GetWebhook(r.log, r.namespace, spod.Spec.WebhookOpts, image, pullPolicy, caInjectType)
+	webhook := bindata.GetWebhook(r.log, r.namespace, spod.Spec.WebhookOpts, image,
+		pullPolicy, caInjectType, spod.Spec.Tolerations)
 	metricsService := bindata.GetMetricsService(r.namespace, caInjectType)
 
 	var certManagerResources *bindata.CertManagerResources
@@ -494,6 +495,10 @@ func (r *ReconcileSPOd) getConfiguredSPOd(
 		ctr := r.baseSPOd.Spec.Template.Spec.Containers[bindata.ContainerIDLogEnricher]
 		ctr.Image = image
 
+		if cfg.Spec.LabelPodDenials {
+			ctr.Args = []string{"log-enricher", "--label-denials"}
+		}
+
 		if useCustomHostProc {
 			ctr.VolumeMounts = append(ctr.VolumeMounts, mount)
 		}
diff --git a/vendor/golang.org/x/sync/errgroup/errgroup.go b/vendor/golang.org/x/sync/errgroup/errgroup.go
new file mode 100644
index 000000000..9857fe53d
--- /dev/null
+++ b/vendor/golang.org/x/sync/errgroup/errgroup.go
@@ -0,0 +1,66 @@
+// Copyright 2016 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package errgroup provides synchronization, error propagation, and Context
+// cancelation for groups of goroutines working on subtasks of a common task.
+package errgroup
+
+import (
+	"context"
+	"sync"
+)
+
+// A Group is a collection of goroutines working on subtasks that are part of
+// the same overall task.
+//
+// A zero Group is valid and does not cancel on error.
+type Group struct {
+	cancel func()
+
+	wg sync.WaitGroup
+
+	errOnce sync.Once
+	err     error
+}
+
+// WithContext returns a new Group and an associated Context derived from ctx.
+//
+// The derived Context is canceled the first time a function passed to Go
+// returns a non-nil error or the first time Wait returns, whichever occurs
+// first.
+func WithContext(ctx context.Context) (*Group, context.Context) {
+	ctx, cancel := context.WithCancel(ctx)
+	return &Group{cancel: cancel}, ctx
+}
+
+// Wait blocks until all function calls from the Go method have returned, then
+// returns the first non-nil error (if any) from them.
+func (g *Group) Wait() error {
+	g.wg.Wait()
+	if g.cancel != nil {
+		g.cancel()
+	}
+	return g.err
+}
+
+// Go calls the given function in a new goroutine.
+//
+// The first call to return a non-nil error cancels the group; its error will be
+// returned by Wait.
+func (g *Group) Go(f func() error) {
+	g.wg.Add(1)
+
+	go func() {
+		defer g.wg.Done()
+
+		if err := f(); err != nil {
+			g.errOnce.Do(func() {
+				g.err = err
+				if g.cancel != nil {
+					g.cancel()
+				}
+			})
+		}
+	}()
+}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index e33c33e22..5db9299a6 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -424,6 +424,7 @@ golang.org/x/oauth2
 golang.org/x/oauth2/internal
 # golang.org/x/sync v0.0.0-20210220032951-036812b2e83c
 ## explicit
+golang.org/x/sync/errgroup
 golang.org/x/sync/singleflight
 # golang.org/x/sys v0.0.0-20220315194320-039c03cc5b86
 ## explicit; go 1.17


Test patch:
diff --git a/hack/ci/e2e-fedora.sh b/hack/ci/e2e-fedora.sh
index ba723a6d2..bc04bff8f 100755
--- a/hack/ci/e2e-fedora.sh
+++ b/hack/ci/e2e-fedora.sh
@@ -18,6 +18,7 @@ set -euo pipefail
 export E2E_CLUSTER_TYPE=vanilla
 export E2E_TEST_SELINUX=true
 export E2E_TEST_LOG_ENRICHER=true
+export E2E_TEST_LABEL_POD_DENIALS=true
 export E2E_TEST_BPF_RECORDER=true
 export E2E_TEST_PROFILE_RECORDING=true
 
diff --git a/internal/pkg/daemon/enricher/enricher_test.go b/internal/pkg/daemon/enricher/enricher_test.go
index 940b0a4b4..2baf341e6 100644
--- a/internal/pkg/daemon/enricher/enricher_test.go
+++ b/internal/pkg/daemon/enricher/enricher_test.go
@@ -330,8 +330,8 @@ func TestRun(t *testing.T) {
 		mock := &enricherfakes.FakeImpl{}
 		tc.prepare(mock, lineChan)
 
-		sut := New(logr.Discard())
-		sut.impl = mock
+		sut, ebuildErr := New(logr.Discard(), false, mock)
+		require.NoError(t, ebuildErr)
 
 		var err error
 		if tc.runAsync {
diff --git a/test/e2e_test.go b/test/e2e_test.go
index 8a7a51200..ed462ff3a 100644
--- a/test/e2e_test.go
+++ b/test/e2e_test.go
@@ -40,11 +40,12 @@ const (
 	// NOTE(jaosorior): We should be able to decrease this once we
 	// migrate to a single daemonset-based implementation for the
 	// SELinux pieces.
-	defaultSelinuxOpTimeout     = "360s"
-	defaultLogEnricherOpTimeout = defaultSelinuxOpTimeout
-	defaultBpfRecorderOpTimeout = defaultSelinuxOpTimeout
-	defaultWaitTimeout          = "180s"
-	defaultWaitTime             = 15 * time.Second
+	defaultSelinuxOpTimeout       = "360s"
+	defaultLogEnricherOpTimeout   = defaultSelinuxOpTimeout
+	defaultBpfRecorderOpTimeout   = defaultSelinuxOpTimeout
+	defaultLabelPodDenialsTimeout = defaultSelinuxOpTimeout
+	defaultWaitTimeout            = "180s"
+	defaultWaitTime               = 15 * time.Second
 )
 
 func (e *e2e) TestSecurityProfilesOperator() {
@@ -95,8 +96,8 @@ func (e *e2e) TestSecurityProfilesOperator() {
 			e.testCaseLogEnricher,
 		},
 		{
-			"SELinux: sanity check",
-			e.testCaseSelinuxSanityCheck,
+			"SELinux: label problematic pod",
+			e.testCaseSelinuxLabelPodDenials,
 		},
 		{
 			"SELinux: base case (install policy, run pod and delete)",
diff --git a/test/suite_test.go b/test/suite_test.go
index e7a165b7d..07206a4be 100644
--- a/test/suite_test.go
+++ b/test/suite_test.go
@@ -54,6 +54,7 @@ var (
 	envSeccompTestsEnabled          = os.Getenv("E2E_TEST_SECCOMP")
 	envProfileRecordingTestsEnabled = os.Getenv("E2E_TEST_PROFILE_RECORDING")
 	envBpfRecorderTestsEnabled      = os.Getenv("E2E_TEST_BPF_RECORDER")
+	envLabelPodDenialsEnabled       = os.Getenv("E2E_TEST_LABEL_POD_DENIALS")
 	containerRuntime                = os.Getenv("CONTAINER_RUNTIME")
 	nodeRootfsPrefix                = os.Getenv("NODE_ROOTFS_PREFIX")
 )
@@ -70,21 +71,22 @@ const (
 
 type e2e struct {
 	suite.Suite
-	containerRuntime     string
-	kubectlPath          string
-	testImage            string
-	selinuxdImage        string
-	pullPolicy           string
-	spodConfig           string
-	nodeRootfsPrefix     string
-	selinuxEnabled       bool
-	logEnricherEnabled   bool
-	testSeccomp          bool
-	testProfileRecording bool
-	bpfRecorderEnabled   bool
-	logger               logr.Logger
-	execNode             func(node string, args ...string) string
-	waitForReadyPods     func()
+	containerRuntime       string
+	kubectlPath            string
+	testImage              string
+	selinuxdImage          string
+	pullPolicy             string
+	spodConfig             string
+	nodeRootfsPrefix       string
+	selinuxEnabled         bool
+	logEnricherEnabled     bool
+	testSeccomp            bool
+	testProfileRecording   bool
+	labelPodDenialsEnabled bool
+	bpfRecorderEnabled     bool
+	logger                 logr.Logger
+	execNode               func(node string, args ...string) string
+	waitForReadyPods       func()
 }
 
 func defaultWaitForReadyPods(e *e2e) {
@@ -137,6 +139,10 @@ func TestSuite(t *testing.T) {
 	if err != nil {
 		bpfRecorderEnabled = false
 	}
+	labelPodDenialsEnabled, err := strconv.ParseBool(envLabelPodDenialsEnabled)
+	if err != nil {
+		labelPodDenialsEnabled = false
+	}
 
 	selinuxdImage := "quay.io/security-profiles-operator/selinuxd"
 	switch {
@@ -146,18 +152,19 @@ func TestSuite(t *testing.T) {
 		}
 		suite.Run(t, &kinde2e{
 			e2e{
-				logger:               klogr.New(),
-				pullPolicy:           "Never",
-				testImage:            testImage,
-				spodConfig:           spodConfig,
-				containerRuntime:     containerRuntime,
-				nodeRootfsPrefix:     nodeRootfsPrefix,
-				selinuxEnabled:       selinuxEnabled,
-				logEnricherEnabled:   logEnricherEnabled,
-				testSeccomp:          testSeccomp,
-				testProfileRecording: testProfileRecording,
-				selinuxdImage:        selinuxdImage,
-				bpfRecorderEnabled:   bpfRecorderEnabled,
+				logger:                 klogr.New(),
+				pullPolicy:             "Never",
+				testImage:              testImage,
+				spodConfig:             spodConfig,
+				containerRuntime:       containerRuntime,
+				nodeRootfsPrefix:       nodeRootfsPrefix,
+				selinuxEnabled:         selinuxEnabled,
+				logEnricherEnabled:     logEnricherEnabled,
+				testSeccomp:            testSeccomp,
+				testProfileRecording:   testProfileRecording,
+				selinuxdImage:          selinuxdImage,
+				bpfRecorderEnabled:     bpfRecorderEnabled,
+				labelPodDenialsEnabled: labelPodDenialsEnabled,
 			},
 			"", "",
 		})
@@ -175,17 +182,18 @@ func TestSuite(t *testing.T) {
 				logger: klogr.New(),
 				// Need to pull the image as it'll be uploaded to the cluster OCP
 				// image registry and not on the nodes.
-				pullPolicy:           "Always",
-				testImage:            testImage,
-				spodConfig:           spodConfig,
-				containerRuntime:     containerRuntime,
-				nodeRootfsPrefix:     nodeRootfsPrefix,
-				selinuxEnabled:       selinuxEnabled,
-				logEnricherEnabled:   logEnricherEnabled,
-				testSeccomp:          testSeccomp,
-				testProfileRecording: testProfileRecording,
-				selinuxdImage:        selinuxdImage,
-				bpfRecorderEnabled:   bpfRecorderEnabled,
+				pullPolicy:             "Always",
+				testImage:              testImage,
+				spodConfig:             spodConfig,
+				containerRuntime:       containerRuntime,
+				nodeRootfsPrefix:       nodeRootfsPrefix,
+				selinuxEnabled:         selinuxEnabled,
+				logEnricherEnabled:     logEnricherEnabled,
+				testSeccomp:            testSeccomp,
+				testProfileRecording:   testProfileRecording,
+				selinuxdImage:          selinuxdImage,
+				bpfRecorderEnabled:     bpfRecorderEnabled,
+				labelPodDenialsEnabled: labelPodDenialsEnabled,
 			},
 			skipBuildImages,
 			skipPushImages,
@@ -197,18 +205,19 @@ func TestSuite(t *testing.T) {
 		selinuxdImage = "quay.io/security-profiles-operator/selinuxd-fedora"
 		suite.Run(t, &vanilla{
 			e2e{
-				logger:               klogr.New(),
-				pullPolicy:           "Never",
-				testImage:            testImage,
-				spodConfig:           spodConfig,
-				containerRuntime:     containerRuntime,
-				nodeRootfsPrefix:     nodeRootfsPrefix,
-				selinuxEnabled:       selinuxEnabled,
-				logEnricherEnabled:   logEnricherEnabled,
-				testSeccomp:          testSeccomp,
-				testProfileRecording: testProfileRecording,
-				selinuxdImage:        selinuxdImage,
-				bpfRecorderEnabled:   bpfRecorderEnabled,
+				logger:                 klogr.New(),
+				pullPolicy:             "Never",
+				testImage:              testImage,
+				spodConfig:             spodConfig,
+				containerRuntime:       containerRuntime,
+				nodeRootfsPrefix:       nodeRootfsPrefix,
+				selinuxEnabled:         selinuxEnabled,
+				logEnricherEnabled:     logEnricherEnabled,
+				testSeccomp:            testSeccomp,
+				testProfileRecording:   testProfileRecording,
+				selinuxdImage:          selinuxdImage,
+				bpfRecorderEnabled:     bpfRecorderEnabled,
+				labelPodDenialsEnabled: labelPodDenialsEnabled,
 			},
 		})
 	default:
@@ -618,3 +627,21 @@ func (e *e2e) enableBpfRecorderInSpod() {
 
 	e.kubectlOperatorNS("rollout", "status", "ds", "spod", "--timeout", defaultBpfRecorderOpTimeout)
 }
+
+func (e *e2e) labelPodDenialsOnlyTestCase() {
+	if !e.labelPodDenialsEnabled {
+		e.T().Skip("Skipping label-denials-pod related test")
+	}
+
+	e.enableLabelingPodDenials()
+}
+
+func (e *e2e) enableLabelingPodDenials() {
+	e.logf("Enable labeling problematic pods in SPOD")
+	e.kubectlOperatorNS("patch", "spod", "spod", "-p", `{"spec":{"labelPodDenials": true}}`, "--type=merge")
+
+	time.Sleep(defaultWaitTime)
+	e.waitInOperatorNSFor("condition=ready", "spod", "spod")
+
+	e.kubectlOperatorNS("rollout", "status", "ds", "spod", "--timeout", defaultLabelPodDenialsTimeout)
+}
diff --git a/test/tc_selinux_sanity_check_test.go b/test/tc_selinux_label_problematic_test.go
similarity index 71%
rename from test/tc_selinux_sanity_check_test.go
rename to test/tc_selinux_label_problematic_test.go
index 7340f888d..7324257c3 100644
--- a/test/tc_selinux_sanity_check_test.go
+++ b/test/tc_selinux_label_problematic_test.go
@@ -16,8 +16,10 @@ limitations under the License.
 
 package e2e_test
 
-func (e *e2e) testCaseSelinuxSanityCheck([]string) {
+func (e *e2e) testCaseSelinuxLabelPodDenials([]string) {
 	e.selinuxOnlyTestCase()
+	e.logEnricherOnlyTestCase()
+	e.labelPodDenialsOnlyTestCase()
 
 	const podWithoutPolicy = `
 apiVersion: v1
@@ -55,5 +57,17 @@ spec:
 	log := e.kubectl("logs", "el-no-policy", "-c", "errorlogger")
 	e.Equalf(expectedLog, log, "container should have returned a 'Permissions Denied' error")
 
+	e.logf("Should be marked as a problematic pod")
+
+	// Naive check label is in the pod's metadata
+	podlabels := e.kubectl("get", "pods", "el-no-policy", "-o", "jsonpath={.metadata.labels}")
+	e.NotEmpty(podlabels, "pod should have labels")
+	e.Contains(podlabels, "spo.x-k8s.io/had-denials", "pod should be marked as problematic")
+
+	// Prove that filtering through label works
+	problematicPodList := e.kubectl("get", "pods", "-l", "spo.x-k8s.io/had-denials=",
+		"-o", "jsonpath={.items[*].metadata.name}")
+	e.NotEmpty(problematicPodList, "problematic pod list should not be empty")
+
 	e.kubectl("delete", "pod", "el-no-policy")
 }