Repository: kubernetes-sigs/security-profiles-operator
Pull request #272 (2021-02-04 10:52:53)

Add `SCMP_ARCH_NATIVE`
#### What type of PR is this?

/kind cleanup

#### What this PR does / why we need it:

We now add the `SCMP_ARCH_NATIVE` to the seccomp profile arches.
#### Which issue(s) this PR fixes:

<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.

Fixes #

or

None
-->
None
#### Does this PR have test?
None
<!--
If tests aren't applicable just write N/A.
-->

#### Special notes for your reviewer:
None
#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
Added support for seccomp CRD architecture `SCMP_ARCH_NATIVE`.
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/272#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/272#pullrequestreview-583268800" title="LGTM">JAORMX</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/272#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
k8s-ci-robot: @saschagrunert: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 3dc74cd324a541dda18260eb9f21e75f42a94c85 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/272/pull-security-profiles-operator-test-e2e/1357280973779111936) | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=272). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: New changes are detected. LGTM label has been removed.
saschagrunert: Scope if this PR slightly changed. :D
k8s-ci-robot: @saschagrunert: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 798ab8760b2f0689362a551dcfcd49bd86ff6389 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/272/pull-security-profiles-operator-test-e2e/1357287761928785920) | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=272). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
saschagrunert: /retest
k8s-ci-robot: @saschagrunert: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 798ab8760b2f0689362a551dcfcd49bd86ff6389 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/272/pull-security-profiles-operator-test-e2e/1357294802495868928) | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=272). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @saschagrunert: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 37e477cb85c4ac5b7a1d2d4389794a1b0e193c32 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/272/pull-security-profiles-operator-test-e2e/1357302899276779520) | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=272). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
JAORMX: /test all

Patch:
diff --git a/api/profilerecording/v1alpha1/profilebinding_types.go b/api/profilerecording/v1alpha1/profilerecording_types.go
similarity index 95%
rename from api/profilerecording/v1alpha1/profilebinding_types.go
rename to api/profilerecording/v1alpha1/profilerecording_types.go
index f211245b7..9e9cd4abd 100644
--- a/api/profilerecording/v1alpha1/profilebinding_types.go
+++ b/api/profilerecording/v1alpha1/profilerecording_types.go
@@ -41,6 +41,7 @@ type ProfileRecordingStatus struct {
 
 // ProfileRecording is the Schema for the profilerecordings API.
 // +kubebuilder:subresource:status
+// +kubebuilder:printcolumn:name="PodSelector",type=string,priority=10,JSONPath=`.spec.podSelector`
 type ProfileRecording struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
diff --git a/api/seccompprofile/v1alpha1/seccompprofile_types.go b/api/seccompprofile/v1alpha1/seccompprofile_types.go
index 89285090a..ee857e8b1 100644
--- a/api/seccompprofile/v1alpha1/seccompprofile_types.go
+++ b/api/seccompprofile/v1alpha1/seccompprofile_types.go
@@ -51,7 +51,7 @@ type SeccompProfileSpec struct {
 }
 
 //nolint:lll
-// +kubebuilder:validation:Enum=SCMP_ARCH_X86;SCMP_ARCH_X86_64;SCMP_ARCH_X32;SCMP_ARCH_ARM;SCMP_ARCH_AARCH64;SCMP_ARCH_MIPS;SCMP_ARCH_MIPS64;SCMP_ARCH_MIPS64N32;SCMP_ARCH_MIPSEL;SCMP_ARCH_MIPSEL64;SCMP_ARCH_MIPSEL64N32;SCMP_ARCH_PPC;SCMP_ARCH_PPC64;SCMP_ARCH_PPC64LE;SCMP_ARCH_S390;SCMP_ARCH_S390X;SCMP_ARCH_PARISC;SCMP_ARCH_PARISC64;SCMP_ARCH_RISCV64
+// +kubebuilder:validation:Enum=SCMP_ARCH_NATIVE;SCMP_ARCH_X86;SCMP_ARCH_X86_64;SCMP_ARCH_X32;SCMP_ARCH_ARM;SCMP_ARCH_AARCH64;SCMP_ARCH_MIPS;SCMP_ARCH_MIPS64;SCMP_ARCH_MIPS64N32;SCMP_ARCH_MIPSEL;SCMP_ARCH_MIPSEL64;SCMP_ARCH_MIPSEL64N32;SCMP_ARCH_PPC;SCMP_ARCH_PPC64;SCMP_ARCH_PPC64LE;SCMP_ARCH_S390;SCMP_ARCH_S390X;SCMP_ARCH_PARISC;SCMP_ARCH_PARISC64;SCMP_ARCH_RISCV64
 type Arch string
 
 // +kubebuilder:validation:Enum=SECCOMP_FILTER_FLAG_TSYNC;SECCOMP_FILTER_FLAG_LOG;SECCOMP_FILTER_FLAG_SPEC_ALLOW
diff --git a/cmd/security-profiles-operator/main.go b/cmd/security-profiles-operator/main.go
index 19e6c6914..af958ae42 100644
--- a/cmd/security-profiles-operator/main.go
+++ b/cmd/security-profiles-operator/main.go
@@ -51,6 +51,7 @@ const (
 	selinuxFlag            string = "with-selinux"
 	nonRootEnablerImageKey string = "RELATED_IMAGE_NON_ROOT_ENABLER"
 	selinuxdImageKey       string = "RELATED_IMAGE_SELINUXD"
+	logEnricherImageKey    string = "RELATED_IMAGE_LOG_ENRICHER"
 	defaultWebhookPort     int    = 9443
 )
 
@@ -222,6 +223,12 @@ func getTunables() (dt spod.DaemonTunables, err error) {
 	}
 	dt.SelinuxdImage = selinuxdImage
 
+	logEnricherImage := os.Getenv(logEnricherImageKey)
+	if logEnricherImage == "" {
+		return dt, errors.New("invalid log enricher image")
+	}
+	dt.LogEnricherImage = logEnricherImage
+
 	return dt, nil
 }
 
diff --git a/deploy/base/config.yaml b/deploy/base/config.yaml
index a7872965f..41da64a8d 100644
--- a/deploy/base/config.yaml
+++ b/deploy/base/config.yaml
@@ -8,3 +8,4 @@ metadata:
     security-profiles-operator/config: ""
 data:
   EnableSelinux: "false"
+  EnableLogEnricher: "false"
diff --git a/deploy/base/crd.yaml b/deploy/base/crd.yaml
index fa7eb6f6d..860f79fd1 100644
--- a/deploy/base/crd.yaml
+++ b/deploy/base/crd.yaml
@@ -49,6 +49,7 @@ spec:
                 description: the architecture used for system calls
                 items:
                   enum:
+                  - SCMP_ARCH_NATIVE
                   - SCMP_ARCH_X86
                   - SCMP_ARCH_X86_64
                   - SCMP_ARCH_X32
diff --git a/deploy/base/kustomization.yaml b/deploy/base/kustomization.yaml
index c1a90b4e2..7ec3fcc99 100644
--- a/deploy/base/kustomization.yaml
+++ b/deploy/base/kustomization.yaml
@@ -27,6 +27,8 @@ patchesStrategicMerge:
                 value: bash:5.0
               - name: RELATED_IMAGE_SELINUXD
                 value: quay.io/jaosorior/selinuxd
+              - name: RELATED_IMAGE_LOG_ENRICHER
+                value: paulinhu/kube-audit-log-enricher
 
 commonLabels:
   app: security-profiles-operator
diff --git a/deploy/base/operator.yaml b/deploy/base/operator.yaml
index 16d11fb72..52a70fe03 100644
--- a/deploy/base/operator.yaml
+++ b/deploy/base/operator.yaml
@@ -31,6 +31,8 @@ spec:
               value: non-root-enabler
             - name: RELATED_IMAGE_SELINUXD
               value: quay.io/jaosorior/selinuxd
+            - name: RELATED_IMAGE_LOG_ENRICHER
+              value: paulinhu/kube-audit-log-enricher
       tolerations:
         - key: "node-role.kubernetes.io/master"
           operator: "Exists"
diff --git a/deploy/base/rbac.yaml b/deploy/base/rbac.yaml
index 1923d3146..ce906db9a 100644
--- a/deploy/base/rbac.yaml
+++ b/deploy/base/rbac.yaml
@@ -170,3 +170,31 @@ roleRef:
   kind: Role
   name: security-profiles-operator
   apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app: security-profiles-operator
+  name: security-profiles-operator-log-enricher
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: security-profiles-operator-log-enricher
+subjects:
+- kind: ServiceAccount
+  name: security-profiles-operator
+  namespace: security-profiles-operator
+roleRef:
+  kind: ClusterRole
+  name: security-profiles-operator-log-enricher
+  apiGroup: rbac.authorization.k8s.io
diff --git a/deploy/base/webhook/crd-recording.yaml b/deploy/base/webhook/crd-recording.yaml
index 312460559..6f60a1177 100644
--- a/deploy/base/webhook/crd-recording.yaml
+++ b/deploy/base/webhook/crd-recording.yaml
@@ -16,7 +16,12 @@ spec:
     singular: profilerecording
   scope: Namespaced
   versions:
-  - name: v1alpha1
+  - additionalPrinterColumns:
+    - jsonPath: .spec.podSelector
+      name: PodSelector
+      priority: 10
+      type: string
+    name: v1alpha1
     schema:
       openAPIV3Schema:
         description: ProfileRecording is the Schema for the profilerecordings API.
diff --git a/deploy/namespace-operator.yaml b/deploy/namespace-operator.yaml
index ad267f6a0..632ab5843 100644
--- a/deploy/namespace-operator.yaml
+++ b/deploy/namespace-operator.yaml
@@ -49,6 +49,7 @@ spec:
                 description: the architecture used for system calls
                 items:
                   enum:
+                  - SCMP_ARCH_NATIVE
                   - SCMP_ARCH_X86
                   - SCMP_ARCH_X86_64
                   - SCMP_ARCH_X32
@@ -475,6 +476,36 @@ subjects:
   name: security-profiles-operator
   namespace: security-profiles-operator
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app: security-profiles-operator
+  name: security-profiles-operator-log-enricher
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app: security-profiles-operator
+  name: security-profiles-operator-log-enricher
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: security-profiles-operator-log-enricher
+subjects:
+- kind: ServiceAccount
+  name: security-profiles-operator
+  namespace: security-profiles-operator
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -506,6 +537,8 @@ spec:
           value: bash:5.0
         - name: RELATED_IMAGE_SELINUXD
           value: quay.io/jaosorior/selinuxd
+        - name: RELATED_IMAGE_LOG_ENRICHER
+          value: paulinhu/kube-audit-log-enricher
         image: gcr.io/k8s-staging-sp-operator/security-profiles-operator:latest
         imagePullPolicy: Always
         name: security-profiles-operator
@@ -526,6 +559,7 @@ spec:
 ---
 apiVersion: v1
 data:
+  EnableLogEnricher: "false"
   EnableSelinux: "false"
 kind: ConfigMap
 metadata:
diff --git a/deploy/operator.yaml b/deploy/operator.yaml
index 49accf19c..e92eb3dcd 100644
--- a/deploy/operator.yaml
+++ b/deploy/operator.yaml
@@ -49,6 +49,7 @@ spec:
                 description: the architecture used for system calls
                 items:
                   enum:
+                  - SCMP_ARCH_NATIVE
                   - SCMP_ARCH_X86
                   - SCMP_ARCH_X86_64
                   - SCMP_ARCH_X32
@@ -474,6 +475,36 @@ subjects:
   name: security-profiles-operator
   namespace: security-profiles-operator
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app: security-profiles-operator
+  name: security-profiles-operator-log-enricher
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app: security-profiles-operator
+  name: security-profiles-operator-log-enricher
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: security-profiles-operator-log-enricher
+subjects:
+- kind: ServiceAccount
+  name: security-profiles-operator
+  namespace: security-profiles-operator
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -503,6 +534,8 @@ spec:
           value: bash:5.0
         - name: RELATED_IMAGE_SELINUXD
           value: quay.io/jaosorior/selinuxd
+        - name: RELATED_IMAGE_LOG_ENRICHER
+          value: paulinhu/kube-audit-log-enricher
         image: gcr.io/k8s-staging-sp-operator/security-profiles-operator:latest
         imagePullPolicy: Always
         name: security-profiles-operator
@@ -523,6 +556,7 @@ spec:
 ---
 apiVersion: v1
 data:
+  EnableLogEnricher: "false"
   EnableSelinux: "false"
 kind: ConfigMap
 metadata:
diff --git a/deploy/webhook.yaml b/deploy/webhook.yaml
index 642c3a3a8..bb867dc07 100644
--- a/deploy/webhook.yaml
+++ b/deploy/webhook.yaml
@@ -92,7 +92,12 @@ spec:
     singular: profilerecording
   scope: Namespaced
   versions:
-  - name: v1alpha1
+  - additionalPrinterColumns:
+    - jsonPath: .spec.podSelector
+      name: PodSelector
+      priority: 10
+      type: string
+    name: v1alpha1
     schema:
       openAPIV3Schema:
         description: ProfileRecording is the Schema for the profilerecordings API.
diff --git a/internal/pkg/config/config.go b/internal/pkg/config/config.go
index f47553a3f..0b4bf1d82 100644
--- a/internal/pkg/config/config.go
+++ b/internal/pkg/config/config.go
@@ -54,7 +54,8 @@ var ProfileRecordingOutputPath = filepath.Join(os.TempDir(), "security-profiles-
 
 // Controller configMap keys.
 const (
-	SPOcEnableSelinux = "EnableSelinux"
+	SPOcEnableSelinux     = "EnableSelinux"
+	SPOcEnableLogEnricher = "EnableLogEnricher"
 )
 
 // GetOperatorNamespace gets the namespace that the operator is currently running on.
diff --git a/internal/pkg/controllers/spod/bindata/spod.go b/internal/pkg/controllers/spod/bindata/spod.go
index ad1644d11..f876803fb 100644
--- a/internal/pkg/controllers/spod/bindata/spod.go
+++ b/internal/pkg/controllers/spod/bindata/spod.go
@@ -30,6 +30,7 @@ var (
 	truly                           = true
 	userRoot                  int64 = 0
 	userRootless              int64 = 2000
+	hostCharDev                     = v1.HostPathCharDev
 	hostPathDirectory               = v1.HostPathDirectory
 	hostPathDirectoryOrCreate       = v1.HostPathDirectoryOrCreate
 )
@@ -39,6 +40,7 @@ const (
 	SelinuxDropDirectory = "/etc/selinux.d"
 	SelinuxdSocketDir    = "/var/run/selinuxd"
 	SelinuxdSocketPath   = SelinuxdSocketDir + "/selinuxd.sock"
+	kmsgPath             = "/dev/kmsg"
 )
 
 var Manifest = &appsv1.DaemonSet{
@@ -301,6 +303,52 @@ var Manifest = &appsv1.DaemonSet{
 						//	},
 						// },
 					},
+					{
+						Name:            "log-enricher",
+						Image:           "paulinhu/kube-audit-log-enricher",
+						ImagePullPolicy: v1.PullAlways,
+						VolumeMounts: []v1.VolumeMount{
+							{
+								Name:      "host-devkmsg-volume",
+								MountPath: kmsgPath,
+								ReadOnly:  true,
+							},
+						},
+						SecurityContext: &v1.SecurityContext{
+							// /dev/kmsg is being used as kernel messages source in order to
+							// support the widest range of distros. However, access to
+							// devices requires the container to run as privileged.
+							Privileged:             &truly,
+							ReadOnlyRootFilesystem: &truly,
+							SELinuxOptions: &v1.SELinuxOptions{
+								// TODO(pjbgf): Use a more restricted selinux type
+								Type: "spc_t",
+							},
+						},
+						Resources: v1.ResourceRequirements{
+							Requests: v1.ResourceList{
+								v1.ResourceMemory:           resource.MustParse("64Mi"),
+								v1.ResourceCPU:              resource.MustParse("50m"),
+								v1.ResourceEphemeralStorage: resource.MustParse("10Mi"),
+							},
+							Limits: v1.ResourceList{
+								v1.ResourceMemory:           resource.MustParse("128Mi"),
+								v1.ResourceCPU:              resource.MustParse("150m"),
+								v1.ResourceEphemeralStorage: resource.MustParse("20Mi"),
+							},
+						},
+						Env: []v1.EnvVar{
+							{
+								Name: "NODE_NAME",
+								ValueFrom: &v1.EnvVarSource{
+									FieldRef: &v1.ObjectFieldSelector{
+										APIVersion: "v1",
+										FieldPath:  "spec.nodeName",
+									},
+								},
+							},
+						},
+					},
 				},
 				Volumes: []v1.Volume{
 					// /var/lib is used as symlinks cannot be created across
@@ -388,6 +436,15 @@ var Manifest = &appsv1.DaemonSet{
 							},
 						},
 					},
+					{
+						Name: "host-devkmsg-volume",
+						VolumeSource: v1.VolumeSource{
+							HostPath: &v1.HostPathVolumeSource{
+								Path: kmsgPath,
+								Type: &hostCharDev,
+							},
+						},
+					},
 				},
 				Tolerations: []v1.Toleration{
 					{
diff --git a/internal/pkg/controllers/spod/configmap_controller.go b/internal/pkg/controllers/spod/configmap_controller.go
index 8044e1b42..8b44ada61 100644
--- a/internal/pkg/controllers/spod/configmap_controller.go
+++ b/internal/pkg/controllers/spod/configmap_controller.go
@@ -160,6 +160,17 @@ func (r *ReconcileSPOd) getConfiguredSPOd(
 			"--with-selinux=true")
 	}
 
+	enableLogEnricher, err := strconv.ParseBool(cfg.Data[config.SPOcEnableLogEnricher])
+	if err == nil && enableLogEnricher {
+		newSPOd.Spec.Template.Spec.Containers = append(
+			newSPOd.Spec.Template.Spec.Containers,
+			r.baseSPOd.Spec.Template.Spec.Containers[2])
+
+		// HostPID is only required for the log-enricher
+		// and is used to access cgroup files to map Process IDs to Pod IDs
+		newSPOd.Spec.Template.Spec.HostPID = true
+	}
+
 	for i := range templateSpec.Containers {
 		templateSpec.Containers[i].ImagePullPolicy = pullPolicy
 	}
diff --git a/internal/pkg/controllers/spod/setup.go b/internal/pkg/controllers/spod/setup.go
index 3694b850f..97f178050 100644
--- a/internal/pkg/controllers/spod/setup.go
+++ b/internal/pkg/controllers/spod/setup.go
@@ -34,11 +34,12 @@ import (
 // TODO(jaosorior): Use better method than a label constant.
 const cmIsSPOdConfig = "security-profiles-operator/config"
 
-// SPOdTunables defines the parameters to tune/modify for the
+// DaemonTunables defines the parameters to tune/modify for the
 // Security-Profiles-Operator-Daemon.
 type DaemonTunables struct {
 	NonRootEnablerImage string
 	SelinuxdImage       string
+	LogEnricherImage    string
 	WatchNamespace      string
 }
 
@@ -73,6 +74,9 @@ func getEffectiveSPOd(dt *DaemonTunables) *appsv1.DaemonSet {
 	selinuxd := &refSPOd.Spec.Template.Spec.Containers[1]
 	selinuxd.Image = dt.SelinuxdImage
 
+	logEnricher := &refSPOd.Spec.Template.Spec.Containers[2]
+	logEnricher.Image = dt.LogEnricherImage
+
 	initcnt := &refSPOd.Spec.Template.Spec.InitContainers[0]
 	initcnt.Image = dt.NonRootEnablerImage
 	sepolImage := &refSPOd.Spec.Template.Spec.InitContainers[1]
diff --git a/profiles b/profiles
deleted file mode 120000
index 346a504b2..000000000
--- a/profiles
+++ /dev/null
@@ -1,1 +0,0 @@
-deploy/base/profiles
\ No newline at end of file


Test patch:
diff --git a/internal/pkg/controllers/spod/setup_test.go b/internal/pkg/controllers/spod/setup_test.go
index b647ad270..bf8061353 100644
--- a/internal/pkg/controllers/spod/setup_test.go
+++ b/internal/pkg/controllers/spod/setup_test.go
@@ -34,13 +34,13 @@ func Test_getEffectiveSPOd(t *testing.T) {
 	}{
 		{
 			"Should correctly set the image",
-			DaemonTunables{"foo:bar", "bar:baz", "brot:wurst"},
+			DaemonTunables{"foo:bar", "bar:baz", "brot:wurst", "fuss:ball"},
 			false,
 			false,
 		},
 		{
 			"Should correctly set the namespace",
-			DaemonTunables{"foo:bar", "bar:baz", "brot:wurst"},
+			DaemonTunables{"foo:bar", "bar:baz", "brot:wurst", "fuss:ball"},
 			true,
 			false,
 		},
@@ -51,6 +51,7 @@ func Test_getEffectiveSPOd(t *testing.T) {
 			t.Parallel()
 			got := getEffectiveSPOd(&tt.dt)
 			require.Equal(t, tt.dt.SelinuxdImage, got.Spec.Template.Spec.Containers[1].Image)
+			require.Equal(t, tt.dt.LogEnricherImage, got.Spec.Template.Spec.Containers[2].Image)
 			require.Equal(t, tt.dt.NonRootEnablerImage, got.Spec.Template.Spec.InitContainers[0].Image)
 			var found bool
 			for _, env := range got.Spec.Template.Spec.Containers[0].Env {