Repository: kubernetes-sigs/security-profiles-operator
Pull request #251 (2021-02-01 21:19:54)

Add log enrichment feature for seccomp
#### What type of PR is this?
/kind feature

#### What this PR does / why we need it:
Enriches seccomp audit logs with Kubernetes information (namespace, pod and container names), allowing SPO users to easily spot what workloads are missing specific syscalls on their profiles.

To illustrate its use, I removed a few syscalls from the operator's profile and this is what I got:
![image](https://user-images.githubusercontent.com/5452977/106530753-d42d6d00-64e4-11eb-807e-fd3e2b16aea3.png)


#### Which issue(s) this PR fixes:

Relates to #244 


#### Does this PR have test?
Not yet

#### Special notes for your reviewer:
- A new RBAC role was created to isolate log enrichment requirements as this may be split from the other components in a follow-up PR.
- The best approach I could find to map PID to Pods was using `HostPID` and reading the `cgroup` file. This approach is container runtime specific and currently only supports CRI-O.
- `HostPID` is only enabled when the log enricher is enabled
- Any suggestion for a better name to replace log enricher?

#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
Add seccomp audit log enrichment feature
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/251#" title="Author self-approved">pjbgf</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [pjbgf]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
pjbgf: I will update the deployment model document with a section for "optional components" I think this may be a good candidate for that given its privileges.

I could not find a lesser privileged approach for the PID->POD mapping, so had to enable `HostPID`, but really keen on hearing ideas on better way around it. @saschagrunert @cmurphy @JAORMX 
k8s-ci-robot: @pjbgf: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-security-profiles-operator-verify | 97f066eb964435e9300b4674db96fd79e0dd423f | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/251/pull-security-profiles-operator-verify/1356362118722490368) | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=251). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Apjbgf). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @pjbgf: PR needs rebase.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
k8s-ci-robot: @pjbgf: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-security-profiles-operator-verify | cb3d0483d386c6da7da69bbcce82c5156a35b020 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/251/pull-security-profiles-operator-verify/1356733366031880192) | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=251). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Apjbgf). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
pjbgf: I have made a few changes in order to broaden support by using `/dev/kmsg` instead of `/var/log/syslog`. Unfortunately, this version requires the container to run as `privileged` in order to have access to said device.

I propose we go ahead with this approach (plus fixing any other feedback) and then on the follow-up PRs:
- Bring dependency code into the project
- Improve testing
- Decrease privilege requirements
- Create security profiles to water tight the feature
- Add documentation
k8s-ci-robot: @pjbgf: PR needs rebase.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
k8s-ci-robot: @pjbgf: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-security-profiles-operator-verify | 3543ae46fade106e8b0ccfc1a47f685e31460db7 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/251/pull-security-profiles-operator-verify/1357110373550919680) | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=251). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Apjbgf). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/251#" title="Author self-approved">pjbgf</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/251#pullrequestreview-583135506" title="Approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [pjbgf,saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
JAORMX: /test all
k8s-ci-robot: @pjbgf: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-security-profiles-operator-verify | 53ecdebb79935574668b99f2fa52dcdcc933ba61 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/251/pull-security-profiles-operator-verify/1357310841069768704) | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=251). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Apjbgf). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @pjbgf: PR needs rebase.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
k8s-ci-robot: @pjbgf: The following tests **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-security-profiles-operator-verify | 53ecdebb79935574668b99f2fa52dcdcc933ba61 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/251/pull-security-profiles-operator-verify/1357310841069768704) | `/test pull-security-profiles-operator-verify`
pull-security-profiles-operator-test-unit | 53ecdebb79935574668b99f2fa52dcdcc933ba61 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/251/pull-security-profiles-operator-test-unit/1357310841120100352) | `/test pull-security-profiles-operator-test-unit`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=251). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Apjbgf). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @pjbgf: The following tests **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-security-profiles-operator-verify | 53ecdebb79935574668b99f2fa52dcdcc933ba61 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/251/pull-security-profiles-operator-verify/1357310841069768704) | `/test pull-security-profiles-operator-verify`
pull-security-profiles-operator-test-unit | 53ecdebb79935574668b99f2fa52dcdcc933ba61 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/251/pull-security-profiles-operator-test-unit/1357310841120100352) | `/test pull-security-profiles-operator-test-unit`
pull-security-profiles-operator-build | 53ecdebb79935574668b99f2fa52dcdcc933ba61 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/251/pull-security-profiles-operator-build/1357310841027825664) | `/test pull-security-profiles-operator-build`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=251). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Apjbgf). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @pjbgf: The following tests **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-security-profiles-operator-verify | 53ecdebb79935574668b99f2fa52dcdcc933ba61 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/251/pull-security-profiles-operator-verify/1357310841069768704) | `/test pull-security-profiles-operator-verify`
pull-security-profiles-operator-test-unit | 53ecdebb79935574668b99f2fa52dcdcc933ba61 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/251/pull-security-profiles-operator-test-unit/1357310841120100352) | `/test pull-security-profiles-operator-test-unit`
pull-security-profiles-operator-build | 53ecdebb79935574668b99f2fa52dcdcc933ba61 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/251/pull-security-profiles-operator-build/1357310841027825664) | `/test pull-security-profiles-operator-build`
pull-security-profiles-operator-build-image | 53ecdebb79935574668b99f2fa52dcdcc933ba61 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/251/pull-security-profiles-operator-build-image/1357310841153654784) | `/test pull-security-profiles-operator-build-image`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=251). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Apjbgf). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @pjbgf: The following tests **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-security-profiles-operator-verify | 53ecdebb79935574668b99f2fa52dcdcc933ba61 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/251/pull-security-profiles-operator-verify/1357310841069768704) | `/test pull-security-profiles-operator-verify`
pull-security-profiles-operator-test-unit | 53ecdebb79935574668b99f2fa52dcdcc933ba61 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/251/pull-security-profiles-operator-test-unit/1357310841120100352) | `/test pull-security-profiles-operator-test-unit`
pull-security-profiles-operator-build | 53ecdebb79935574668b99f2fa52dcdcc933ba61 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/251/pull-security-profiles-operator-build/1357310841027825664) | `/test pull-security-profiles-operator-build`
pull-security-profiles-operator-build-image | 53ecdebb79935574668b99f2fa52dcdcc933ba61 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/251/pull-security-profiles-operator-build-image/1357310841153654784) | `/test pull-security-profiles-operator-build-image`
pull-security-profiles-operator-test-e2e | 53ecdebb79935574668b99f2fa52dcdcc933ba61 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/251/pull-security-profiles-operator-test-e2e/1357310841199792128) | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=251). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Apjbgf). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @pjbgf: The following tests **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-security-profiles-operator-build-image | 53ecdebb79935574668b99f2fa52dcdcc933ba61 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/251/pull-security-profiles-operator-build-image/1357310841153654784) | `/test pull-security-profiles-operator-build-image`
pull-security-profiles-operator-test-e2e | 53ecdebb79935574668b99f2fa52dcdcc933ba61 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/251/pull-security-profiles-operator-test-e2e/1357310841199792128) | `/test pull-security-profiles-operator-test-e2e`
pull-security-profiles-operator-verify | 07582239b3551e644a0be74fab33c4007f193975 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/251/pull-security-profiles-operator-verify/1357417659238453248) | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=251). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Apjbgf). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/251#" title="Author self-approved">pjbgf</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/251#pullrequestreview-583790726" title="LGTM">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [pjbgf,saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->

Patch:
diff --git a/cmd/security-profiles-operator/main.go b/cmd/security-profiles-operator/main.go
index 19e6c6914..af958ae42 100644
--- a/cmd/security-profiles-operator/main.go
+++ b/cmd/security-profiles-operator/main.go
@@ -51,6 +51,7 @@ const (
 	selinuxFlag            string = "with-selinux"
 	nonRootEnablerImageKey string = "RELATED_IMAGE_NON_ROOT_ENABLER"
 	selinuxdImageKey       string = "RELATED_IMAGE_SELINUXD"
+	logEnricherImageKey    string = "RELATED_IMAGE_LOG_ENRICHER"
 	defaultWebhookPort     int    = 9443
 )
 
@@ -222,6 +223,12 @@ func getTunables() (dt spod.DaemonTunables, err error) {
 	}
 	dt.SelinuxdImage = selinuxdImage
 
+	logEnricherImage := os.Getenv(logEnricherImageKey)
+	if logEnricherImage == "" {
+		return dt, errors.New("invalid log enricher image")
+	}
+	dt.LogEnricherImage = logEnricherImage
+
 	return dt, nil
 }
 
diff --git a/deploy/base/config.yaml b/deploy/base/config.yaml
index a7872965f..41da64a8d 100644
--- a/deploy/base/config.yaml
+++ b/deploy/base/config.yaml
@@ -8,3 +8,4 @@ metadata:
     security-profiles-operator/config: ""
 data:
   EnableSelinux: "false"
+  EnableLogEnricher: "false"
diff --git a/deploy/base/kustomization.yaml b/deploy/base/kustomization.yaml
index c1a90b4e2..7ec3fcc99 100644
--- a/deploy/base/kustomization.yaml
+++ b/deploy/base/kustomization.yaml
@@ -27,6 +27,8 @@ patchesStrategicMerge:
                 value: bash:5.0
               - name: RELATED_IMAGE_SELINUXD
                 value: quay.io/jaosorior/selinuxd
+              - name: RELATED_IMAGE_LOG_ENRICHER
+                value: paulinhu/kube-audit-log-enricher
 
 commonLabels:
   app: security-profiles-operator
diff --git a/deploy/base/operator.yaml b/deploy/base/operator.yaml
index 16d11fb72..52a70fe03 100644
--- a/deploy/base/operator.yaml
+++ b/deploy/base/operator.yaml
@@ -31,6 +31,8 @@ spec:
               value: non-root-enabler
             - name: RELATED_IMAGE_SELINUXD
               value: quay.io/jaosorior/selinuxd
+            - name: RELATED_IMAGE_LOG_ENRICHER
+              value: paulinhu/kube-audit-log-enricher
       tolerations:
         - key: "node-role.kubernetes.io/master"
           operator: "Exists"
diff --git a/deploy/base/rbac.yaml b/deploy/base/rbac.yaml
index 1923d3146..ce906db9a 100644
--- a/deploy/base/rbac.yaml
+++ b/deploy/base/rbac.yaml
@@ -170,3 +170,31 @@ roleRef:
   kind: Role
   name: security-profiles-operator
   apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app: security-profiles-operator
+  name: security-profiles-operator-log-enricher
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: security-profiles-operator-log-enricher
+subjects:
+- kind: ServiceAccount
+  name: security-profiles-operator
+  namespace: security-profiles-operator
+roleRef:
+  kind: ClusterRole
+  name: security-profiles-operator-log-enricher
+  apiGroup: rbac.authorization.k8s.io
diff --git a/deploy/namespace-operator.yaml b/deploy/namespace-operator.yaml
index ad267f6a0..3b13d842b 100644
--- a/deploy/namespace-operator.yaml
+++ b/deploy/namespace-operator.yaml
@@ -475,6 +475,36 @@ subjects:
   name: security-profiles-operator
   namespace: security-profiles-operator
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app: security-profiles-operator
+  name: security-profiles-operator-log-enricher
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app: security-profiles-operator
+  name: security-profiles-operator-log-enricher
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: security-profiles-operator-log-enricher
+subjects:
+- kind: ServiceAccount
+  name: security-profiles-operator
+  namespace: security-profiles-operator
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -506,6 +536,8 @@ spec:
           value: bash:5.0
         - name: RELATED_IMAGE_SELINUXD
           value: quay.io/jaosorior/selinuxd
+        - name: RELATED_IMAGE_LOG_ENRICHER
+          value: paulinhu/kube-audit-log-enricher
         image: gcr.io/k8s-staging-sp-operator/security-profiles-operator:latest
         imagePullPolicy: Always
         name: security-profiles-operator
@@ -526,6 +558,7 @@ spec:
 ---
 apiVersion: v1
 data:
+  EnableLogEnricher: "false"
   EnableSelinux: "false"
 kind: ConfigMap
 metadata:
diff --git a/deploy/operator.yaml b/deploy/operator.yaml
index 49accf19c..728c635ab 100644
--- a/deploy/operator.yaml
+++ b/deploy/operator.yaml
@@ -474,6 +474,36 @@ subjects:
   name: security-profiles-operator
   namespace: security-profiles-operator
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app: security-profiles-operator
+  name: security-profiles-operator-log-enricher
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app: security-profiles-operator
+  name: security-profiles-operator-log-enricher
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: security-profiles-operator-log-enricher
+subjects:
+- kind: ServiceAccount
+  name: security-profiles-operator
+  namespace: security-profiles-operator
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -503,6 +533,8 @@ spec:
           value: bash:5.0
         - name: RELATED_IMAGE_SELINUXD
           value: quay.io/jaosorior/selinuxd
+        - name: RELATED_IMAGE_LOG_ENRICHER
+          value: paulinhu/kube-audit-log-enricher
         image: gcr.io/k8s-staging-sp-operator/security-profiles-operator:latest
         imagePullPolicy: Always
         name: security-profiles-operator
@@ -523,6 +555,7 @@ spec:
 ---
 apiVersion: v1
 data:
+  EnableLogEnricher: "false"
   EnableSelinux: "false"
 kind: ConfigMap
 metadata:
diff --git a/internal/pkg/config/config.go b/internal/pkg/config/config.go
index f47553a3f..0b4bf1d82 100644
--- a/internal/pkg/config/config.go
+++ b/internal/pkg/config/config.go
@@ -54,7 +54,8 @@ var ProfileRecordingOutputPath = filepath.Join(os.TempDir(), "security-profiles-
 
 // Controller configMap keys.
 const (
-	SPOcEnableSelinux = "EnableSelinux"
+	SPOcEnableSelinux     = "EnableSelinux"
+	SPOcEnableLogEnricher = "EnableLogEnricher"
 )
 
 // GetOperatorNamespace gets the namespace that the operator is currently running on.
diff --git a/internal/pkg/controllers/spod/bindata/spod.go b/internal/pkg/controllers/spod/bindata/spod.go
index ad1644d11..f876803fb 100644
--- a/internal/pkg/controllers/spod/bindata/spod.go
+++ b/internal/pkg/controllers/spod/bindata/spod.go
@@ -30,6 +30,7 @@ var (
 	truly                           = true
 	userRoot                  int64 = 0
 	userRootless              int64 = 2000
+	hostCharDev                     = v1.HostPathCharDev
 	hostPathDirectory               = v1.HostPathDirectory
 	hostPathDirectoryOrCreate       = v1.HostPathDirectoryOrCreate
 )
@@ -39,6 +40,7 @@ const (
 	SelinuxDropDirectory = "/etc/selinux.d"
 	SelinuxdSocketDir    = "/var/run/selinuxd"
 	SelinuxdSocketPath   = SelinuxdSocketDir + "/selinuxd.sock"
+	kmsgPath             = "/dev/kmsg"
 )
 
 var Manifest = &appsv1.DaemonSet{
@@ -301,6 +303,52 @@ var Manifest = &appsv1.DaemonSet{
 						//	},
 						// },
 					},
+					{
+						Name:            "log-enricher",
+						Image:           "paulinhu/kube-audit-log-enricher",
+						ImagePullPolicy: v1.PullAlways,
+						VolumeMounts: []v1.VolumeMount{
+							{
+								Name:      "host-devkmsg-volume",
+								MountPath: kmsgPath,
+								ReadOnly:  true,
+							},
+						},
+						SecurityContext: &v1.SecurityContext{
+							// /dev/kmsg is being used as kernel messages source in order to
+							// support the widest range of distros. However, access to
+							// devices requires the container to run as privileged.
+							Privileged:             &truly,
+							ReadOnlyRootFilesystem: &truly,
+							SELinuxOptions: &v1.SELinuxOptions{
+								// TODO(pjbgf): Use a more restricted selinux type
+								Type: "spc_t",
+							},
+						},
+						Resources: v1.ResourceRequirements{
+							Requests: v1.ResourceList{
+								v1.ResourceMemory:           resource.MustParse("64Mi"),
+								v1.ResourceCPU:              resource.MustParse("50m"),
+								v1.ResourceEphemeralStorage: resource.MustParse("10Mi"),
+							},
+							Limits: v1.ResourceList{
+								v1.ResourceMemory:           resource.MustParse("128Mi"),
+								v1.ResourceCPU:              resource.MustParse("150m"),
+								v1.ResourceEphemeralStorage: resource.MustParse("20Mi"),
+							},
+						},
+						Env: []v1.EnvVar{
+							{
+								Name: "NODE_NAME",
+								ValueFrom: &v1.EnvVarSource{
+									FieldRef: &v1.ObjectFieldSelector{
+										APIVersion: "v1",
+										FieldPath:  "spec.nodeName",
+									},
+								},
+							},
+						},
+					},
 				},
 				Volumes: []v1.Volume{
 					// /var/lib is used as symlinks cannot be created across
@@ -388,6 +436,15 @@ var Manifest = &appsv1.DaemonSet{
 							},
 						},
 					},
+					{
+						Name: "host-devkmsg-volume",
+						VolumeSource: v1.VolumeSource{
+							HostPath: &v1.HostPathVolumeSource{
+								Path: kmsgPath,
+								Type: &hostCharDev,
+							},
+						},
+					},
 				},
 				Tolerations: []v1.Toleration{
 					{
diff --git a/internal/pkg/controllers/spod/configmap_controller.go b/internal/pkg/controllers/spod/configmap_controller.go
index 8044e1b42..8b44ada61 100644
--- a/internal/pkg/controllers/spod/configmap_controller.go
+++ b/internal/pkg/controllers/spod/configmap_controller.go
@@ -160,6 +160,17 @@ func (r *ReconcileSPOd) getConfiguredSPOd(
 			"--with-selinux=true")
 	}
 
+	enableLogEnricher, err := strconv.ParseBool(cfg.Data[config.SPOcEnableLogEnricher])
+	if err == nil && enableLogEnricher {
+		newSPOd.Spec.Template.Spec.Containers = append(
+			newSPOd.Spec.Template.Spec.Containers,
+			r.baseSPOd.Spec.Template.Spec.Containers[2])
+
+		// HostPID is only required for the log-enricher
+		// and is used to access cgroup files to map Process IDs to Pod IDs
+		newSPOd.Spec.Template.Spec.HostPID = true
+	}
+
 	for i := range templateSpec.Containers {
 		templateSpec.Containers[i].ImagePullPolicy = pullPolicy
 	}
diff --git a/internal/pkg/controllers/spod/setup.go b/internal/pkg/controllers/spod/setup.go
index a43373b45..97f178050 100644
--- a/internal/pkg/controllers/spod/setup.go
+++ b/internal/pkg/controllers/spod/setup.go
@@ -39,6 +39,7 @@ const cmIsSPOdConfig = "security-profiles-operator/config"
 type DaemonTunables struct {
 	NonRootEnablerImage string
 	SelinuxdImage       string
+	LogEnricherImage    string
 	WatchNamespace      string
 }
 
@@ -73,6 +74,9 @@ func getEffectiveSPOd(dt *DaemonTunables) *appsv1.DaemonSet {
 	selinuxd := &refSPOd.Spec.Template.Spec.Containers[1]
 	selinuxd.Image = dt.SelinuxdImage
 
+	logEnricher := &refSPOd.Spec.Template.Spec.Containers[2]
+	logEnricher.Image = dt.LogEnricherImage
+
 	initcnt := &refSPOd.Spec.Template.Spec.InitContainers[0]
 	initcnt.Image = dt.NonRootEnablerImage
 	sepolImage := &refSPOd.Spec.Template.Spec.InitContainers[1]


Test patch:
diff --git a/internal/pkg/controllers/spod/setup_test.go b/internal/pkg/controllers/spod/setup_test.go
index b647ad270..bf8061353 100644
--- a/internal/pkg/controllers/spod/setup_test.go
+++ b/internal/pkg/controllers/spod/setup_test.go
@@ -34,13 +34,13 @@ func Test_getEffectiveSPOd(t *testing.T) {
 	}{
 		{
 			"Should correctly set the image",
-			DaemonTunables{"foo:bar", "bar:baz", "brot:wurst"},
+			DaemonTunables{"foo:bar", "bar:baz", "brot:wurst", "fuss:ball"},
 			false,
 			false,
 		},
 		{
 			"Should correctly set the namespace",
-			DaemonTunables{"foo:bar", "bar:baz", "brot:wurst"},
+			DaemonTunables{"foo:bar", "bar:baz", "brot:wurst", "fuss:ball"},
 			true,
 			false,
 		},
@@ -51,6 +51,7 @@ func Test_getEffectiveSPOd(t *testing.T) {
 			t.Parallel()
 			got := getEffectiveSPOd(&tt.dt)
 			require.Equal(t, tt.dt.SelinuxdImage, got.Spec.Template.Spec.Containers[1].Image)
+			require.Equal(t, tt.dt.LogEnricherImage, got.Spec.Template.Spec.Containers[2].Image)
 			require.Equal(t, tt.dt.NonRootEnablerImage, got.Spec.Template.Spec.InitContainers[0].Image)
 			var found bool
 			for _, env := range got.Spec.Template.Spec.Containers[0].Env {