Repository: kubernetes-sigs/security-profiles-operator
Pull request #396 (2021-04-08 05:59:40)

Change SelinuxPolicy to SelinuxProfile
#### What type of PR is this?

/kind cleanup
/kind api-change

#### What this PR does / why we need it:

SelinuxPolicy was always a little different when it shouldn't be. In order to
standardize on naming and make this a more cohesive operator, this changes the
name of the aforementioned object to SelinuxProfile. Thus matching
`SeccompProfile` which was supported from the start.

#### Which issue(s) this PR fixes:

None

#### Does this PR have test?

N/A.

#### Does this PR introduce a user-facing change?

```release-note
SelinuxPolicy has been removed and is now SelinuxProfile.
```

k8s-ci-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/396#" title="Author self-approved">JAORMX</a>*
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please assign **saschagrunert** after the PR has been reviewed.
You can assign the PR to them by writing `/assign @saschagrunert` in a comment when ready.

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["saschagrunert"]} -->
k8s-ci-robot: @JAORMX: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-security-profiles-operator-verify | e6d38f77c6d879561a764f9a53b9598c5728ac56 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/396/pull-security-profiles-operator-verify/1380037612667932672) | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=396). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
JAORMX: /assign @saschagrunert 
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/396#" title="Author self-approved">JAORMX</a>*
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please ask for approval from **saschagrunert** after the PR has been reviewed.

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["saschagrunert"]} -->
JAORMX: @saschagrunert thanks for the review! Addressed the comments.
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/396#" title="Author self-approved">JAORMX</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/396#pullrequestreview-631113449" title="Approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->

Patch:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1d9a29127..326fdb1cc 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -20,10 +20,11 @@ jobs:
     steps:
       - uses: actions/checkout@v2
       - uses: cachix/install-nix-action@v12
-      - uses: cachix/cachix-action@v8
+      - uses: cachix/cachix-action@v10
         with:
           name: security-profiles-operator
           authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+          pushFilter: security-profiles-operator
       - run: make nix nix-arm64
 
   image:
diff --git a/Makefile b/Makefile
index 9ccff380b..8e5330599 100644
--- a/Makefile
+++ b/Makefile
@@ -232,7 +232,7 @@ manifests:
 	$(CONTROLLER_GEN_CMD) $(CRD_OPTIONS) paths="./api/spod/..." output:crd:stdout > deploy/base/crd.yaml
 	$(CONTROLLER_GEN_CMD) $(CRD_OPTIONS) paths="./api/secprofnodestatus/..." output:crd:stdout >> deploy/base/crd.yaml
 	$(CONTROLLER_GEN_CMD) $(CRD_OPTIONS) paths="./api/seccompprofile/..." output:crd:stdout >> deploy/base/crd.yaml
-	$(CONTROLLER_GEN_CMD) $(CRD_OPTIONS) paths="./api/selinuxpolicy/..." output:crd:stdout >> deploy/base/crd.yaml
+	$(CONTROLLER_GEN_CMD) $(CRD_OPTIONS) paths="./api/selinuxprofile/..." output:crd:stdout >> deploy/base/crd.yaml
 	$(CONTROLLER_GEN_CMD) $(CRD_OPTIONS) paths="./api/profilebinding/..." output:crd:stdout > deploy/base/webhook/crd-binding.yaml
 	$(CONTROLLER_GEN_CMD) $(CRD_OPTIONS) paths="./api/profilerecording/..." output:crd:stdout > deploy/base/webhook/crd-recording.yaml
 
diff --git a/api/profilebinding/v1alpha1/profilebinding_types.go b/api/profilebinding/v1alpha1/profilebinding_types.go
index 1f6052b3f..62ef8db75 100644
--- a/api/profilebinding/v1alpha1/profilebinding_types.go
+++ b/api/profilebinding/v1alpha1/profilebinding_types.go
@@ -32,7 +32,7 @@ type ProfileBindingSpec struct {
 type ProfileRef struct {
 	// Kind of object to be bound.
 	// +kubebuilder:validation:Enum=SeccompProfile
-	Kind string `json:"kind"` // TODO(cmurphy) add SelinuxPolicy
+	Kind string `json:"kind"` // TODO(cmurphy) add SelinuxProfile
 	// Name of the profile within the current namespace to which to bind the selected pods.
 	Name string `json:"name"`
 }
diff --git a/api/selinuxpolicy/v1alpha1/groupversion_info.go b/api/selinuxprofile/v1alpha1/groupversion_info.go
similarity index 100%
rename from api/selinuxpolicy/v1alpha1/groupversion_info.go
rename to api/selinuxprofile/v1alpha1/groupversion_info.go
diff --git a/api/selinuxpolicy/v1alpha1/selinuxpolicy_types.go b/api/selinuxprofile/v1alpha1/selinuxpolicy_types.go
similarity index 62%
rename from api/selinuxpolicy/v1alpha1/selinuxpolicy_types.go
rename to api/selinuxprofile/v1alpha1/selinuxpolicy_types.go
index 55a1fc3c0..550e5c280 100644
--- a/api/selinuxpolicy/v1alpha1/selinuxpolicy_types.go
+++ b/api/selinuxprofile/v1alpha1/selinuxpolicy_types.go
@@ -22,72 +22,72 @@ import (
 	profilebasev1alpha1 "sigs.k8s.io/security-profiles-operator/api/profilebase/v1alpha1"
 )
 
-// Ensure SelinuxPolicy implements the StatusBaseUser interface.
-var _ profilebasev1alpha1.StatusBaseUser = &SelinuxPolicy{}
+// Ensure SelinuxProfile implements the StatusBaseUser interface.
+var _ profilebasev1alpha1.StatusBaseUser = &SelinuxProfile{}
 
-// SelinuxPolicySpec defines the desired state of SelinuxPolicy.
-type SelinuxPolicySpec struct {
+// SelinuxProfileSpec defines the desired state of SelinuxProfile.
+type SelinuxProfileSpec struct {
 	Apply  bool   `json:"apply,omitempty"`
 	Policy string `json:"policy,omitempty"`
 }
 
-// SelinuxPolicyStatus defines the observed state of SelinuxPolicy.
-type SelinuxPolicyStatus struct {
+// SelinuxProfileStatus defines the observed state of SelinuxProfile.
+type SelinuxProfileStatus struct {
 	profilebasev1alpha1.StatusBase `json:",inline"`
-	// Represents the string that the SelinuxPolicy object can be
+	// Represents the string that the SelinuxProfile object can be
 	// referenced as in a pod seLinuxOptions section.
 	Usage string `json:"usage,omitempty"`
 }
 
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 
-// SelinuxPolicy is the Schema for the selinuxpolicies API.
+// SelinuxProfile is the Schema for the selinuxprofiles API.
 // +kubebuilder:subresource:status
-// +kubebuilder:resource:path=selinuxpolicies,scope=Namespaced
+// +kubebuilder:resource:path=selinuxprofiles,scope=Namespaced
 // +kubebuilder:printcolumn:name="Usage",type="string",JSONPath=`.status.usage`
 // +kubebuilder:printcolumn:name="Apply",type="boolean",JSONPath=`.spec.apply`
 // +kubebuilder:printcolumn:name="State",type="string",JSONPath=`.status.status`
-type SelinuxPolicy struct {
+type SelinuxProfile struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
 
-	Spec   SelinuxPolicySpec   `json:"spec,omitempty"`
-	Status SelinuxPolicyStatus `json:"status,omitempty"`
+	Spec   SelinuxProfileSpec   `json:"spec,omitempty"`
+	Status SelinuxProfileStatus `json:"status,omitempty"`
 }
 
-func (sp *SelinuxPolicy) GetStatusBase() *profilebasev1alpha1.StatusBase {
+func (sp *SelinuxProfile) GetStatusBase() *profilebasev1alpha1.StatusBase {
 	return &sp.Status.StatusBase
 }
 
-func (sp *SelinuxPolicy) DeepCopyToStatusBaseIf() profilebasev1alpha1.StatusBaseUser {
+func (sp *SelinuxProfile) DeepCopyToStatusBaseIf() profilebasev1alpha1.StatusBaseUser {
 	return sp.DeepCopy()
 }
 
-func (sp *SelinuxPolicy) SetImplementationStatus() {
+func (sp *SelinuxProfile) SetImplementationStatus() {
 	sp.Status.Usage = sp.GetPolicyUsage()
 }
 
 // GetPolicyName gets the policy module name in the format that
 // we're expecting for parsing.
-func (sp *SelinuxPolicy) GetPolicyName() string {
+func (sp *SelinuxProfile) GetPolicyName() string {
 	return sp.GetName() + "_" + sp.GetNamespace()
 }
 
 // GetPolicyUsage is the representation of how a pod will call this
 // SELinux module.
-func (sp *SelinuxPolicy) GetPolicyUsage() string {
+func (sp *SelinuxProfile) GetPolicyUsage() string {
 	return sp.GetPolicyName() + ".process"
 }
 
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 
-// SelinuxPolicyList contains a list of SelinuxPolicy.
-type SelinuxPolicyList struct {
+// SelinuxProfileList contains a list of SelinuxProfile.
+type SelinuxProfileList struct {
 	metav1.TypeMeta `json:",inline"`
 	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []SelinuxPolicy `json:"items"`
+	Items           []SelinuxProfile `json:"items"`
 }
 
 func init() { //nolint:gochecknoinits
-	SchemeBuilder.Register(&SelinuxPolicy{}, &SelinuxPolicyList{})
+	SchemeBuilder.Register(&SelinuxProfile{}, &SelinuxProfileList{})
 }
diff --git a/api/selinuxpolicy/v1alpha1/zz_generated.deepcopy.go b/api/selinuxprofile/v1alpha1/zz_generated.deepcopy.go
similarity index 71%
rename from api/selinuxpolicy/v1alpha1/zz_generated.deepcopy.go
rename to api/selinuxprofile/v1alpha1/zz_generated.deepcopy.go
index 975ecba1a..9de8363da 100644
--- a/api/selinuxpolicy/v1alpha1/zz_generated.deepcopy.go
+++ b/api/selinuxprofile/v1alpha1/zz_generated.deepcopy.go
@@ -25,7 +25,7 @@ import (
 )
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *SelinuxPolicy) DeepCopyInto(out *SelinuxPolicy) {
+func (in *SelinuxProfile) DeepCopyInto(out *SelinuxProfile) {
 	*out = *in
 	out.TypeMeta = in.TypeMeta
 	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
@@ -33,18 +33,18 @@ func (in *SelinuxPolicy) DeepCopyInto(out *SelinuxPolicy) {
 	in.Status.DeepCopyInto(&out.Status)
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SelinuxPolicy.
-func (in *SelinuxPolicy) DeepCopy() *SelinuxPolicy {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SelinuxProfile.
+func (in *SelinuxProfile) DeepCopy() *SelinuxProfile {
 	if in == nil {
 		return nil
 	}
-	out := new(SelinuxPolicy)
+	out := new(SelinuxProfile)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *SelinuxPolicy) DeepCopyObject() runtime.Object {
+func (in *SelinuxProfile) DeepCopyObject() runtime.Object {
 	if c := in.DeepCopy(); c != nil {
 		return c
 	}
@@ -52,31 +52,31 @@ func (in *SelinuxPolicy) DeepCopyObject() runtime.Object {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *SelinuxPolicyList) DeepCopyInto(out *SelinuxPolicyList) {
+func (in *SelinuxProfileList) DeepCopyInto(out *SelinuxProfileList) {
 	*out = *in
 	out.TypeMeta = in.TypeMeta
 	in.ListMeta.DeepCopyInto(&out.ListMeta)
 	if in.Items != nil {
 		in, out := &in.Items, &out.Items
-		*out = make([]SelinuxPolicy, len(*in))
+		*out = make([]SelinuxProfile, len(*in))
 		for i := range *in {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SelinuxPolicyList.
-func (in *SelinuxPolicyList) DeepCopy() *SelinuxPolicyList {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SelinuxProfileList.
+func (in *SelinuxProfileList) DeepCopy() *SelinuxProfileList {
 	if in == nil {
 		return nil
 	}
-	out := new(SelinuxPolicyList)
+	out := new(SelinuxProfileList)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *SelinuxPolicyList) DeepCopyObject() runtime.Object {
+func (in *SelinuxProfileList) DeepCopyObject() runtime.Object {
 	if c := in.DeepCopy(); c != nil {
 		return c
 	}
@@ -84,32 +84,32 @@ func (in *SelinuxPolicyList) DeepCopyObject() runtime.Object {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *SelinuxPolicySpec) DeepCopyInto(out *SelinuxPolicySpec) {
+func (in *SelinuxProfileSpec) DeepCopyInto(out *SelinuxProfileSpec) {
 	*out = *in
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SelinuxPolicySpec.
-func (in *SelinuxPolicySpec) DeepCopy() *SelinuxPolicySpec {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SelinuxProfileSpec.
+func (in *SelinuxProfileSpec) DeepCopy() *SelinuxProfileSpec {
 	if in == nil {
 		return nil
 	}
-	out := new(SelinuxPolicySpec)
+	out := new(SelinuxProfileSpec)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *SelinuxPolicyStatus) DeepCopyInto(out *SelinuxPolicyStatus) {
+func (in *SelinuxProfileStatus) DeepCopyInto(out *SelinuxProfileStatus) {
 	*out = *in
 	in.StatusBase.DeepCopyInto(&out.StatusBase)
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SelinuxPolicyStatus.
-func (in *SelinuxPolicyStatus) DeepCopy() *SelinuxPolicyStatus {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SelinuxProfileStatus.
+func (in *SelinuxProfileStatus) DeepCopy() *SelinuxProfileStatus {
 	if in == nil {
 		return nil
 	}
-	out := new(SelinuxPolicyStatus)
+	out := new(SelinuxProfileStatus)
 	in.DeepCopyInto(out)
 	return out
 }
diff --git a/cmd/security-profiles-operator/main.go b/cmd/security-profiles-operator/main.go
index 048d93dfd..d015a56af 100644
--- a/cmd/security-profiles-operator/main.go
+++ b/cmd/security-profiles-operator/main.go
@@ -40,13 +40,13 @@ import (
 	profilerecording1alpha1 "sigs.k8s.io/security-profiles-operator/api/profilerecording/v1alpha1"
 	seccompprofilev1alpha1 "sigs.k8s.io/security-profiles-operator/api/seccompprofile/v1alpha1"
 	secprofnodestatusv1alpha1 "sigs.k8s.io/security-profiles-operator/api/secprofnodestatus/v1alpha1"
-	selinuxpolicyv1alpha1 "sigs.k8s.io/security-profiles-operator/api/selinuxpolicy/v1alpha1"
+	selinuxprofilev1alpha1 "sigs.k8s.io/security-profiles-operator/api/selinuxprofile/v1alpha1"
 	spodv1alpha1 "sigs.k8s.io/security-profiles-operator/api/spod/v1alpha1"
 	"sigs.k8s.io/security-profiles-operator/internal/pkg/config"
 	"sigs.k8s.io/security-profiles-operator/internal/pkg/daemon/enricher"
 	"sigs.k8s.io/security-profiles-operator/internal/pkg/daemon/profilerecorder"
 	"sigs.k8s.io/security-profiles-operator/internal/pkg/daemon/seccompprofile"
-	"sigs.k8s.io/security-profiles-operator/internal/pkg/daemon/selinuxpolicy"
+	"sigs.k8s.io/security-profiles-operator/internal/pkg/daemon/selinuxprofile"
 	nodestatus "sigs.k8s.io/security-profiles-operator/internal/pkg/manager/nodestatus"
 	"sigs.k8s.io/security-profiles-operator/internal/pkg/manager/spod"
 	wa "sigs.k8s.io/security-profiles-operator/internal/pkg/manager/workloadannotator"
@@ -207,8 +207,8 @@ func runManager(ctx *cli.Context) error {
 	if err := seccompprofilev1alpha1.AddToScheme(mgr.GetScheme()); err != nil {
 		return errors.Wrap(err, "add seccompprofile API to scheme")
 	}
-	if err := selinuxpolicyv1alpha1.AddToScheme(mgr.GetScheme()); err != nil {
-		return errors.Wrap(err, "add selinuxpolicy API to scheme")
+	if err := selinuxprofilev1alpha1.AddToScheme(mgr.GetScheme()); err != nil {
+		return errors.Wrap(err, "add selinuxprofile API to scheme")
 	}
 
 	// This API provides status which is used by both seccomp and selinux
@@ -345,8 +345,8 @@ func getEnabledControllers(ctx *cli.Context) []*controllerSettings {
 	if ctx.Bool(selinuxFlag) {
 		enabledSettings = append(enabledSettings, &controllerSettings{
 			name:          "selinux-spod",
-			setupFn:       selinuxpolicy.Setup,
-			schemaBuilder: selinuxpolicyv1alpha1.SchemeBuilder,
+			setupFn:       selinuxprofile.Setup,
+			schemaBuilder: selinuxprofilev1alpha1.SchemeBuilder,
 		})
 	}
 
diff --git a/deploy/base/crd.yaml b/deploy/base/crd.yaml
index 3522a04d9..6d840be98 100644
--- a/deploy/base/crd.yaml
+++ b/deploy/base/crd.yaml
@@ -462,14 +462,14 @@ metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.5.0
   creationTimestamp: null
-  name: selinuxpolicies.security-profiles-operator.x-k8s.io
+  name: selinuxprofiles.security-profiles-operator.x-k8s.io
 spec:
   group: security-profiles-operator.x-k8s.io
   names:
-    kind: SelinuxPolicy
-    listKind: SelinuxPolicyList
-    plural: selinuxpolicies
-    singular: selinuxpolicy
+    kind: SelinuxProfile
+    listKind: SelinuxProfileList
+    plural: selinuxprofiles
+    singular: selinuxprofile
   scope: Namespaced
   versions:
   - additionalPrinterColumns:
@@ -485,7 +485,7 @@ spec:
     name: v1alpha1
     schema:
       openAPIV3Schema:
-        description: SelinuxPolicy is the Schema for the selinuxpolicies API.
+        description: SelinuxProfile is the Schema for the selinuxprofiles API.
         properties:
           apiVersion:
             description: 'APIVersion defines the versioned schema of this representation
@@ -500,7 +500,7 @@ spec:
           metadata:
             type: object
           spec:
-            description: SelinuxPolicySpec defines the desired state of SelinuxPolicy.
+            description: SelinuxProfileSpec defines the desired state of SelinuxProfile.
             properties:
               apply:
                 type: boolean
@@ -508,7 +508,7 @@ spec:
                 type: string
             type: object
           status:
-            description: SelinuxPolicyStatus defines the observed state of SelinuxPolicy.
+            description: SelinuxProfileStatus defines the observed state of SelinuxProfile.
             properties:
               conditions:
                 description: Conditions of the resource.
@@ -550,8 +550,8 @@ spec:
                   API.
                 type: string
               usage:
-                description: Represents the string that the SelinuxPolicy object can
-                  be referenced as in a pod seLinuxOptions section.
+                description: Represents the string that the SelinuxProfile object
+                  can be referenced as in a pod seLinuxOptions section.
                 type: string
             type: object
         type: object
diff --git a/deploy/base/role.yaml b/deploy/base/role.yaml
index e145cab15..dfc1cf62d 100644
--- a/deploy/base/role.yaml
+++ b/deploy/base/role.yaml
@@ -120,7 +120,7 @@ rules:
 - apiGroups:
   - security-profiles-operator.x-k8s.io
   resources:
-  - selinuxpolicies
+  - selinuxprofiles
   verbs:
   - create
   - get
@@ -131,7 +131,7 @@ rules:
 - apiGroups:
   - security-profiles-operator.x-k8s.io
   resources:
-  - selinuxpolicies/finalizers
+  - selinuxprofiles/finalizers
   verbs:
   - delete
   - get
@@ -140,7 +140,7 @@ rules:
 - apiGroups:
   - security-profiles-operator.x-k8s.io
   resources:
-  - selinuxpolicies/status
+  - selinuxprofiles/status
   verbs:
   - get
   - patch
@@ -250,7 +250,7 @@ rules:
 - apiGroups:
   - security-profiles-operator.x-k8s.io
   resources:
-  - selinuxpolicies
+  - selinuxprofiles
   verbs:
   - create
   - get
@@ -261,7 +261,7 @@ rules:
 - apiGroups:
   - security-profiles-operator.x-k8s.io
   resources:
-  - selinuxpolicies/finalizers
+  - selinuxprofiles/finalizers
   verbs:
   - delete
   - get
@@ -270,7 +270,7 @@ rules:
 - apiGroups:
   - security-profiles-operator.x-k8s.io
   resources:
-  - selinuxpolicies/status
+  - selinuxprofiles/status
   verbs:
   - get
   - patch
diff --git a/deploy/namespace-operator.yaml b/deploy/namespace-operator.yaml
index 7c73b90af..bc561779a 100644
--- a/deploy/namespace-operator.yaml
+++ b/deploy/namespace-operator.yaml
@@ -407,14 +407,14 @@ metadata:
   creationTimestamp: null
   labels:
     app: security-profiles-operator
-  name: selinuxpolicies.security-profiles-operator.x-k8s.io
+  name: selinuxprofiles.security-profiles-operator.x-k8s.io
 spec:
   group: security-profiles-operator.x-k8s.io
   names:
-    kind: SelinuxPolicy
-    listKind: SelinuxPolicyList
-    plural: selinuxpolicies
-    singular: selinuxpolicy
+    kind: SelinuxProfile
+    listKind: SelinuxProfileList
+    plural: selinuxprofiles
+    singular: selinuxprofile
   scope: Namespaced
   versions:
   - additionalPrinterColumns:
@@ -430,7 +430,7 @@ spec:
     name: v1alpha1
     schema:
       openAPIV3Schema:
-        description: SelinuxPolicy is the Schema for the selinuxpolicies API.
+        description: SelinuxProfile is the Schema for the selinuxprofiles API.
         properties:
           apiVersion:
             description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
@@ -441,7 +441,7 @@ spec:
           metadata:
             type: object
           spec:
-            description: SelinuxPolicySpec defines the desired state of SelinuxPolicy.
+            description: SelinuxProfileSpec defines the desired state of SelinuxProfile.
             properties:
               apply:
                 type: boolean
@@ -449,7 +449,7 @@ spec:
                 type: string
             type: object
           status:
-            description: SelinuxPolicyStatus defines the observed state of SelinuxPolicy.
+            description: SelinuxProfileStatus defines the observed state of SelinuxProfile.
             properties:
               conditions:
                 description: Conditions of the resource.
@@ -483,7 +483,7 @@ spec:
                 description: ProfileState defines the state that the profile is in. A profile in this context refers to a SeccompProfile or a SELinux profile, the states are shared between them as well as the management API.
                 type: string
               usage:
-                description: Represents the string that the SelinuxPolicy object can be referenced as in a pod seLinuxOptions section.
+                description: Represents the string that the SelinuxProfile object can be referenced as in a pod seLinuxOptions section.
                 type: string
             type: object
         type: object
@@ -643,7 +643,7 @@ rules:
 - apiGroups:
   - security-profiles-operator.x-k8s.io
   resources:
-  - selinuxpolicies
+  - selinuxprofiles
   verbs:
   - create
   - get
@@ -654,7 +654,7 @@ rules:
 - apiGroups:
   - security-profiles-operator.x-k8s.io
   resources:
-  - selinuxpolicies/finalizers
+  - selinuxprofiles/finalizers
   verbs:
   - delete
   - get
@@ -663,7 +663,7 @@ rules:
 - apiGroups:
   - security-profiles-operator.x-k8s.io
   resources:
-  - selinuxpolicies/status
+  - selinuxprofiles/status
   verbs:
   - get
   - patch
@@ -775,7 +775,7 @@ rules:
 - apiGroups:
   - security-profiles-operator.x-k8s.io
   resources:
-  - selinuxpolicies
+  - selinuxprofiles
   verbs:
   - create
   - get
@@ -786,7 +786,7 @@ rules:
 - apiGroups:
   - security-profiles-operator.x-k8s.io
   resources:
-  - selinuxpolicies/finalizers
+  - selinuxprofiles/finalizers
   verbs:
   - delete
   - get
@@ -795,7 +795,7 @@ rules:
 - apiGroups:
   - security-profiles-operator.x-k8s.io
   resources:
-  - selinuxpolicies/status
+  - selinuxprofiles/status
   verbs:
   - get
   - patch
diff --git a/deploy/operator.yaml b/deploy/operator.yaml
index 2a48b3348..228ef5d67 100644
--- a/deploy/operator.yaml
+++ b/deploy/operator.yaml
@@ -407,14 +407,14 @@ metadata:
   creationTimestamp: null
   labels:
     app: security-profiles-operator
-  name: selinuxpolicies.security-profiles-operator.x-k8s.io
+  name: selinuxprofiles.security-profiles-operator.x-k8s.io
 spec:
   group: security-profiles-operator.x-k8s.io
   names:
-    kind: SelinuxPolicy
-    listKind: SelinuxPolicyList
-    plural: selinuxpolicies
-    singular: selinuxpolicy
+    kind: SelinuxProfile
+    listKind: SelinuxProfileList
+    plural: selinuxprofiles
+    singular: selinuxprofile
   scope: Namespaced
   versions:
   - additionalPrinterColumns:
@@ -430,7 +430,7 @@ spec:
     name: v1alpha1
     schema:
       openAPIV3Schema:
-        description: SelinuxPolicy is the Schema for the selinuxpolicies API.
+        description: SelinuxProfile is the Schema for the selinuxprofiles API.
         properties:
           apiVersion:
             description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
@@ -441,7 +441,7 @@ spec:
           metadata:
             type: object
           spec:
-            description: SelinuxPolicySpec defines the desired state of SelinuxPolicy.
+            description: SelinuxProfileSpec defines the desired state of SelinuxProfile.
             properties:
               apply:
                 type: boolean
@@ -449,7 +449,7 @@ spec:
                 type: string
             type: object
           status:
-            description: SelinuxPolicyStatus defines the observed state of SelinuxPolicy.
+            description: SelinuxProfileStatus defines the observed state of SelinuxProfile.
             properties:
               conditions:
                 description: Conditions of the resource.
@@ -483,7 +483,7 @@ spec:
                 description: ProfileState defines the state that the profile is in. A profile in this context refers to a SeccompProfile or a SELinux profile, the states are shared between them as well as the management API.
                 type: string
               usage:
-                description: Represents the string that the SelinuxPolicy object can be referenced as in a pod seLinuxOptions section.
+                description: Represents the string that the SelinuxProfile object can be referenced as in a pod seLinuxOptions section.
                 type: string
             type: object
         type: object
@@ -643,7 +643,7 @@ rules:
 - apiGroups:
   - security-profiles-operator.x-k8s.io
   resources:
-  - selinuxpolicies
+  - selinuxprofiles
   verbs:
   - create
   - get
@@ -654,7 +654,7 @@ rules:
 - apiGroups:
   - security-profiles-operator.x-k8s.io
   resources:
-  - selinuxpolicies/finalizers
+  - selinuxprofiles/finalizers
   verbs:
   - delete
   - get
@@ -663,7 +663,7 @@ rules:
 - apiGroups:
   - security-profiles-operator.x-k8s.io
   resources:
-  - selinuxpolicies/status
+  - selinuxprofiles/status
   verbs:
   - get
   - patch
@@ -775,7 +775,7 @@ rules:
 - apiGroups:
   - security-profiles-operator.x-k8s.io
   resources:
-  - selinuxpolicies
+  - selinuxprofiles
   verbs:
   - create
   - get
@@ -786,7 +786,7 @@ rules:
 - apiGroups:
   - security-profiles-operator.x-k8s.io
   resources:
-  - selinuxpolicies/finalizers
+  - selinuxprofiles/finalizers
   verbs:
   - delete
   - get
@@ -795,7 +795,7 @@ rules:
 - apiGroups:
   - security-profiles-operator.x-k8s.io
   resources:
-  - selinuxpolicies/status
+  - selinuxprofiles/status
   verbs:
   - get
   - patch
diff --git a/examples/selinuxpolicy.yaml b/examples/selinuxprofile.yaml
similarity index 95%
rename from examples/selinuxpolicy.yaml
rename to examples/selinuxprofile.yaml
index f8c92603c..bf3b1a5da 100644
--- a/examples/selinuxpolicy.yaml
+++ b/examples/selinuxprofile.yaml
@@ -1,5 +1,5 @@
 apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
-kind: SelinuxPolicy
+kind: SelinuxProfile
 metadata:
   name: errorlogger
 spec:
diff --git a/internal/pkg/daemon/selinuxpolicy/selinuxpolicy_controller.go b/internal/pkg/daemon/selinuxprofile/selinuxpolicy_controller.go
similarity index 88%
rename from internal/pkg/daemon/selinuxpolicy/selinuxpolicy_controller.go
rename to internal/pkg/daemon/selinuxprofile/selinuxpolicy_controller.go
index 12b343564..cc936ad40 100644
--- a/internal/pkg/daemon/selinuxpolicy/selinuxpolicy_controller.go
+++ b/internal/pkg/daemon/selinuxprofile/selinuxpolicy_controller.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package selinuxpolicy
+package selinuxprofile
 
 import (
 	"bytes"
@@ -39,14 +39,14 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
 	statusv1alpha1 "sigs.k8s.io/security-profiles-operator/api/secprofnodestatus/v1alpha1"
-	selinuxpolicyv1alpha1 "sigs.k8s.io/security-profiles-operator/api/selinuxpolicy/v1alpha1"
+	selinuxprofilev1alpha1 "sigs.k8s.io/security-profiles-operator/api/selinuxprofile/v1alpha1"
 	"sigs.k8s.io/security-profiles-operator/internal/pkg/manager/spod/bindata"
 	"sigs.k8s.io/security-profiles-operator/internal/pkg/nodestatus"
 )
 
 // The underscore is not a valid character in a pod, so we can
 // safely use it as a separator.
-const policyWrapper = `(block {{.Name}}_{{.Namespace}}
+const profileWrapper = `(block {{.Name}}_{{.Namespace}}
     {{.Policy}}
 )`
 
@@ -71,10 +71,10 @@ type sePolStatus struct {
 	Status sePolStatusType
 }
 
-// blank assignment to verify that ReconcileSelinuxPolicy implements `reconcile.Reconciler`.
+// blank assignment to verify that ReconcileSelinuxProfile implements `reconcile.Reconciler`.
 var _ reconcile.Reconciler = &ReconcileSP{}
 
-// ReconcileSP reconciles a SelinuxPolicy object.
+// ReconcileSP reconciles a SelinuxProfile object.
 type ReconcileSP struct {
 	// This client, initialized using mgr.Client() above, is a split client
 	// that reads objects from the cache and writes to the apiserver.
@@ -84,21 +84,21 @@ type ReconcileSP struct {
 	record         event.Recorder
 }
 
-// Security Profiles Operator RBAC permissions to manage SelinuxPolicy
+// Security Profiles Operator RBAC permissions to manage SelinuxProfile
 // nolint:lll
-// +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=selinuxpolicies,verbs=get;list;watch;create;update;patch
-// +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=selinuxpolicies/status,verbs=get;update;patch
-// +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=selinuxpolicies/finalizers,verbs=delete;get;update;patch
+// +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=selinuxprofiles,verbs=get;list;watch;create;update;patch
+// +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=selinuxprofiles/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=selinuxprofiles/finalizers,verbs=delete;get;update;patch
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=securityprofilenodestatuses,verbs=get;list;watch;create;update;patch;delete
 
-// Reconcile reads that state of the cluster for a SelinuxPolicy object and makes changes based on the state read
-// and what is in the `SelinuxPolicy.Spec`.
+// Reconcile reads that state of the cluster for a SelinuxProfile object and makes changes based on the state read
+// and what is in the `SelinuxProfile.Spec`.
 func (r *ReconcileSP) Reconcile(_ context.Context, request reconcile.Request) (reconcile.Result, error) {
 	reqLogger := log.WithValues("Request.Namespace", request.Namespace, "Request.Name", request.Name)
-	reqLogger.Info("Reconciling SelinuxPolicy")
+	reqLogger.Info("Reconciling SelinuxProfile")
 
-	// Fetch the SelinuxPolicy instance
-	instance := &selinuxpolicyv1alpha1.SelinuxPolicy{}
+	// Fetch the SelinuxProfile instance
+	instance := &selinuxprofilev1alpha1.SelinuxProfile{}
 	err := r.client.Get(context.TODO(), request.NamespacedName, instance)
 	if err != nil {
 		return reconcile.Result{}, IgnoreNotFound(err)
@@ -154,7 +154,7 @@ func (r *ReconcileSP) Reconcile(_ context.Context, request reconcile.Request) (r
 }
 
 func (r *ReconcileSP) reconcilePolicy(
-	sp *selinuxpolicyv1alpha1.SelinuxPolicy, nodeStatus *nodestatus.StatusClient, l logr.Logger,
+	sp *selinuxprofilev1alpha1.SelinuxProfile, nodeStatus *nodestatus.StatusClient, l logr.Logger,
 ) (reconcile.Result, error) {
 	selinuxdReady, err := isSelinuxdReady()
 	if err != nil {
@@ -201,7 +201,7 @@ func (r *ReconcileSP) reconcilePolicy(
 	return reconcile.Result{}, nil
 }
 
-func (r *ReconcileSP) reconcilePolicyFile(sp *selinuxpolicyv1alpha1.SelinuxPolicy, l logr.Logger) error {
+func (r *ReconcileSP) reconcilePolicyFile(sp *selinuxprofilev1alpha1.SelinuxProfile, l logr.Logger) error {
 	policyPath := path.Join(bindata.SelinuxDropDirectory, sp.GetPolicyName()+".cil")
 	policyContent := []byte(r.wrapPolicy(sp))
 
@@ -243,7 +243,7 @@ func writeFileIfDiffers(filePath string, contents []byte) error {
 }
 
 func (r *ReconcileSP) reconcileDeletePolicy(
-	sp *selinuxpolicyv1alpha1.SelinuxPolicy, nodeStatus *nodestatus.StatusClient, l logr.Logger,
+	sp *selinuxprofilev1alpha1.SelinuxProfile, nodeStatus *nodestatus.StatusClient, l logr.Logger,
 ) (reconcile.Result, error) {
 	selinuxdReady, err := isSelinuxdReady()
 	if err != nil {
@@ -283,7 +283,7 @@ func (r *ReconcileSP) reconcileDeletePolicy(
 	return reconcile.Result{}, nil
 }
 
-func (r *ReconcileSP) reconcileDeletePolicyFile(sp *selinuxpolicyv1alpha1.SelinuxPolicy,
+func (r *ReconcileSP) reconcileDeletePolicyFile(sp *selinuxprofilev1alpha1.SelinuxProfile,
 	l logr.Logger) (reconcile.Result, error) {
 	policyPath := path.Join(bindata.SelinuxDropDirectory, sp.GetPolicyName()+".cil")
 
@@ -306,7 +306,7 @@ func (r *ReconcileSP) reconcileDeletePolicyFile(sp *selinuxpolicyv1alpha1.Selinu
 	return reconcile.Result{Requeue: true}, errors.Wrap(err, "error removing policy file")
 }
 
-func (r *ReconcileSP) wrapPolicy(cr *selinuxpolicyv1alpha1.SelinuxPolicy) string {
+func (r *ReconcileSP) wrapPolicy(cr *selinuxprofilev1alpha1.SelinuxProfile) string {
 	parsedpolicy := strings.TrimSpace(cr.Spec.Policy)
 	// ident
 	parsedpolicy = strings.ReplaceAll(parsedpolicy, "\n", "\n    ")
@@ -323,7 +323,7 @@ func (r *ReconcileSP) wrapPolicy(cr *selinuxpolicyv1alpha1.SelinuxPolicy) string
 	}
 	var result bytes.Buffer
 	if err := r.policyTemplate.Execute(&result, data); err != nil {
-		log.Error(err, "Couldn't render policy", "SelinuxPolicy.Name", cr.GetName())
+		log.Error(err, "Couldn't render policy", "SelinuxProfile.Name", cr.GetName())
 	}
 	return result.String()
 }
@@ -364,7 +364,7 @@ func isSelinuxdReady() (bool, error) {
 	return status[selinuxdReadyKey], nil
 }
 
-func getPolicyStatus(sp *selinuxpolicyv1alpha1.SelinuxPolicy) (*sePolStatus, error) {
+func getPolicyStatus(sp *selinuxprofilev1alpha1.SelinuxProfile) (*sePolStatus, error) {
 	polURL := selinuxdPoliciesBaseURL + sp.GetPolicyName()
 	response, err := selinuxdGetRequest(polURL)
 	if err != nil {
diff --git a/internal/pkg/daemon/selinuxpolicy/setup.go b/internal/pkg/daemon/selinuxprofile/setup.go
similarity index 79%
rename from internal/pkg/daemon/selinuxpolicy/setup.go
rename to internal/pkg/daemon/selinuxprofile/setup.go
index b24fee577..ae3e8c802 100644
--- a/internal/pkg/daemon/selinuxpolicy/setup.go
+++ b/internal/pkg/daemon/selinuxprofile/setup.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package selinuxpolicy
+package selinuxprofile
 
 import (
 	"context"
@@ -26,26 +26,26 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
 
-	spov1alpha1 "sigs.k8s.io/security-profiles-operator/api/selinuxpolicy/v1alpha1"
+	spov1alpha1 "sigs.k8s.io/security-profiles-operator/api/selinuxprofile/v1alpha1"
 )
 
-var log = logf.Log.WithName("selinuxpolicy")
+var log = logf.Log.WithName("selinuxprofile")
 
 // Setup adds a controller that reconciles seccomp profiles.
 func Setup(ctx context.Context, mgr ctrl.Manager, l logr.Logger) error {
 	// Create template to wrap policies
-	tmpl, err := template.New("policyWrapper").Parse(policyWrapper)
+	tmpl, err := template.New("profileWrapper").Parse(profileWrapper)
 	if err != nil {
-		return errors.Wrap(err, "creating policy wrapper template")
+		return errors.Wrap(err, "creating profile wrapper template")
 	}
-	// Register the regular reconciler to manage SelinuxPolicies
+	// Register the regular reconciler to manage SelinuxProfiles
 	return ctrl.NewControllerManagedBy(mgr).
 		Named("profile").
-		For(&spov1alpha1.SelinuxPolicy{}).
+		For(&spov1alpha1.SelinuxProfile{}).
 		Complete(&ReconcileSP{
 			client:         mgr.GetClient(),
 			scheme:         mgr.GetScheme(),
 			policyTemplate: tmpl,
-			record:         event.NewAPIRecorder(mgr.GetEventRecorderFor("selinuxpolicy")),
+			record:         event.NewAPIRecorder(mgr.GetEventRecorderFor("selinuxprofile")),
 		})
 }
diff --git a/internal/pkg/daemon/selinuxpolicy/utils.go b/internal/pkg/daemon/selinuxprofile/utils.go
similarity index 89%
rename from internal/pkg/daemon/selinuxpolicy/utils.go
rename to internal/pkg/daemon/selinuxprofile/utils.go
index 82f52104d..9dbe16bdb 100644
--- a/internal/pkg/daemon/selinuxpolicy/utils.go
+++ b/internal/pkg/daemon/selinuxprofile/utils.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package selinuxpolicy
+package selinuxprofile
 
 // NOTE(jaosorior): We can probably use a library for generating names instead
 // of using this.
@@ -30,8 +30,8 @@ import (
 	"k8s.io/apimachinery/pkg/api/errors"
 )
 
-// GetPolicyK8sName gets the policy name in a format that's OK for k8s names.
-func GetPolicyK8sName(name, ns string) string {
+// GetProfileK8sName gets the policy name in a format that's OK for k8s names.
+func GetProfileK8sName(name, ns string) string {
 	return name + "-" + ns
 }
 
@@ -46,7 +46,7 @@ func parseNodeName(name string) string {
 func GetInstallerPodName(name, ns string, node *corev1.Node) string {
 	// policy-installer
 	parsedNodeName := parseNodeName(node.Name)
-	podname := GetPolicyK8sName(name, ns) + "-" + parsedNodeName
+	podname := GetProfileK8sName(name, ns) + "-" + parsedNodeName
 
 	hasher := hash.New()
 	if _, err := io.WriteString(hasher, podname); err != nil {
@@ -59,7 +59,7 @@ func GetInstallerPodName(name, ns string, node *corev1.Node) string {
 // GetPolicyConfigMapName Gets the configMap name for a given policy.
 func GetPolicyConfigMapName(name, ns string) string {
 	namePrefix := "policy-for"
-	return namePrefix + "-" + GetPolicyK8sName(name, ns)
+	return namePrefix + "-" + GetProfileK8sName(name, ns)
 }
 
 // SliceContainsString helper function to check if a string is in a slice of strings.
diff --git a/internal/pkg/manager/nodestatus/nodestatus.go b/internal/pkg/manager/nodestatus/nodestatus.go
index 512549991..02e060f1c 100644
--- a/internal/pkg/manager/nodestatus/nodestatus.go
+++ b/internal/pkg/manager/nodestatus/nodestatus.go
@@ -35,7 +35,7 @@ import (
 	pbv1alpha1 "sigs.k8s.io/security-profiles-operator/api/profilebase/v1alpha1"
 	seccompv1alpha1 "sigs.k8s.io/security-profiles-operator/api/seccompprofile/v1alpha1"
 	statusv1alpha1 "sigs.k8s.io/security-profiles-operator/api/secprofnodestatus/v1alpha1"
-	selinuxv1alpha1 "sigs.k8s.io/security-profiles-operator/api/selinuxpolicy/v1alpha1"
+	selinuxv1alpha1 "sigs.k8s.io/security-profiles-operator/api/selinuxprofile/v1alpha1"
 	"sigs.k8s.io/security-profiles-operator/internal/pkg/config"
 	"sigs.k8s.io/security-profiles-operator/internal/pkg/util"
 )
@@ -65,11 +65,11 @@ func NewStatusReconciler(cli client.Client, log logr.Logger, record event.Record
 	}
 }
 
-// Security Profiles Operator RBAC permissions to manage SelinuxPolicy
+// Security Profiles Operator RBAC permissions to manage SelinuxProfile
 // nolint:lll
-// +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=selinuxpolicies,verbs=get;list;watch;create;update;patch
-// +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=selinuxpolicies/status,verbs=get;update;patch
-// +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=selinuxpolicies/finalizers,verbs=delete;get;update;patch
+// +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=selinuxprofiles,verbs=get;list;watch;create;update;patch
+// +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=selinuxprofiles/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=selinuxprofiles/finalizers,verbs=delete;get;update;patch
 
 // Security Profiles Operator RBAC permissions to manage SeccompProfile
 // nolint:lll
@@ -207,8 +207,8 @@ func (r *StatusReconciler) getProfileFromStatus(
 	switch ctrl.Kind {
 	case "SeccompProfile":
 		prof = &seccompv1alpha1.SeccompProfile{}
-	case "SelinuxPolicy":
-		prof = &selinuxv1alpha1.SelinuxPolicy{}
+	case "SelinuxProfile":
+		prof = &selinuxv1alpha1.SelinuxProfile{}
 	default:
 		return nil, errors.Wrapf(ErrUnkownOwnerKind, "getting owner profile")
 	}
diff --git a/internal/pkg/webhooks/recording/impl.go b/internal/pkg/webhooks/recording/impl.go
index 8e921ce3d..acd7e31a4 100644
--- a/internal/pkg/webhooks/recording/impl.go
+++ b/internal/pkg/webhooks/recording/impl.go
@@ -22,6 +22,8 @@ import (
 	"github.com/go-logr/logr"
 	"github.com/pkg/errors"
 	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 
@@ -41,6 +43,7 @@ type impl interface {
 	UpdateResource(context.Context, logr.Logger, client.Object, string) error
 	SetDecoder(*admission.Decoder)
 	DecodePod(admission.Request) (*corev1.Pod, error)
+	LabelSelectorAsSelector(*metav1.LabelSelector) (labels.Selector, error)
 }
 
 func (d *defaultImpl) ListProfileRecordings(
@@ -70,3 +73,9 @@ func (d *defaultImpl) DecodePod(req admission.Request) (*corev1.Pod, error) {
 	err := d.decoder.Decode(req, pod)
 	return pod, errors.Wrap(err, "decode pod")
 }
+
+func (*defaultImpl) LabelSelectorAsSelector(
+	ps *metav1.LabelSelector,
+) (labels.Selector, error) {
+	return metav1.LabelSelectorAsSelector(ps)
+}
diff --git a/internal/pkg/webhooks/recording/recording.go b/internal/pkg/webhooks/recording/recording.go
index 003f6d896..5881c16d1 100644
--- a/internal/pkg/webhooks/recording/recording.go
+++ b/internal/pkg/webhooks/recording/recording.go
@@ -29,7 +29,6 @@ import (
 	"github.com/pkg/errors"
 	admissionv1 "k8s.io/api/admission/v1"
 	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
@@ -116,7 +115,7 @@ func (p *podSeccompRecorder) Handle(
 			continue
 		}
 
-		selector, err := metav1.LabelSelectorAsSelector(
+		selector, err := p.impl.LabelSelectorAsSelector(
 			&item.Spec.PodSelector,
 		)
 		if err != nil {
diff --git a/internal/pkg/webhooks/recording/recordingfakes/fake_impl.go b/internal/pkg/webhooks/recording/recordingfakes/fake_impl.go
index a9c25f4d0..8fa8e3b8f 100644
--- a/internal/pkg/webhooks/recording/recordingfakes/fake_impl.go
+++ b/internal/pkg/webhooks/recording/recordingfakes/fake_impl.go
@@ -23,6 +23,8 @@ import (
 
 	"github.com/go-logr/logr"
 	v1 "k8s.io/api/core/v1"
+	v1a "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 	"sigs.k8s.io/security-profiles-operator/api/profilerecording/v1alpha1"
@@ -42,6 +44,19 @@ type FakeImpl struct {
 		result1 *v1.Pod
 		result2 error
 	}
+	LabelSelectorAsSelectorStub        func(*v1a.LabelSelector) (labels.Selector, error)
+	labelSelectorAsSelectorMutex       sync.RWMutex
+	labelSelectorAsSelectorArgsForCall []struct {
+		arg1 *v1a.LabelSelector
+	}
+	labelSelectorAsSelectorReturns struct {
+		result1 labels.Selector
+		result2 error
+	}
+	labelSelectorAsSelectorReturnsOnCall map[int]struct {
+		result1 labels.Selector
+		result2 error
+	}
 	ListProfileRecordingsStub        func(context.Context, ...client.ListOption) (*v1alpha1.ProfileRecordingList, error)
 	listProfileRecordingsMutex       sync.RWMutex
 	listProfileRecordingsArgsForCall []struct {
@@ -143,6 +158,70 @@ func (fake *FakeImpl) DecodePodReturnsOnCall(i int, result1 *v1.Pod, result2 err
 	}{result1, result2}
 }
 
+func (fake *FakeImpl) LabelSelectorAsSelector(arg1 *v1a.LabelSelector) (labels.Selector, error) {
+	fake.labelSelectorAsSelectorMutex.Lock()
+	ret, specificReturn := fake.labelSelectorAsSelectorReturnsOnCall[len(fake.labelSelectorAsSelectorArgsForCall)]
+	fake.labelSelectorAsSelectorArgsForCall = append(fake.labelSelectorAsSelectorArgsForCall, struct {
+		arg1 *v1a.LabelSelector
+	}{arg1})
+	stub := fake.LabelSelectorAsSelectorStub
+	fakeReturns := fake.labelSelectorAsSelectorReturns
+	fake.recordInvocation("LabelSelectorAsSelector", []interface{}{arg1})
+	fake.labelSelectorAsSelectorMutex.Unlock()
+	if stub != nil {
+		return stub(arg1)
+	}
+	if specificReturn {
+		return ret.result1, ret.result2
+	}
+	return fakeReturns.result1, fakeReturns.result2
+}
+
+func (fake *FakeImpl) LabelSelectorAsSelectorCallCount() int {
+	fake.labelSelectorAsSelectorMutex.RLock()
+	defer fake.labelSelectorAsSelectorMutex.RUnlock()
+	return len(fake.labelSelectorAsSelectorArgsForCall)
+}
+
+func (fake *FakeImpl) LabelSelectorAsSelectorCalls(stub func(*v1a.LabelSelector) (labels.Selector, error)) {
+	fake.labelSelectorAsSelectorMutex.Lock()
+	defer fake.labelSelectorAsSelectorMutex.Unlock()
+	fake.LabelSelectorAsSelectorStub = stub
+}
+
+func (fake *FakeImpl) LabelSelectorAsSelectorArgsForCall(i int) *v1a.LabelSelector {
+	fake.labelSelectorAsSelectorMutex.RLock()
+	defer fake.labelSelectorAsSelectorMutex.RUnlock()
+	argsForCall := fake.labelSelectorAsSelectorArgsForCall[i]
+	return argsForCall.arg1
+}
+
+func (fake *FakeImpl) LabelSelectorAsSelectorReturns(result1 labels.Selector, result2 error) {
+	fake.labelSelectorAsSelectorMutex.Lock()
+	defer fake.labelSelectorAsSelectorMutex.Unlock()
+	fake.LabelSelectorAsSelectorStub = nil
+	fake.labelSelectorAsSelectorReturns = struct {
+		result1 labels.Selector
+		result2 error
+	}{result1, result2}
+}
+
+func (fake *FakeImpl) LabelSelectorAsSelectorReturnsOnCall(i int, result1 labels.Selector, result2 error) {
+	fake.labelSelectorAsSelectorMutex.Lock()
+	defer fake.labelSelectorAsSelectorMutex.Unlock()
+	fake.LabelSelectorAsSelectorStub = nil
+	if fake.labelSelectorAsSelectorReturnsOnCall == nil {
+		fake.labelSelectorAsSelectorReturnsOnCall = make(map[int]struct {
+			result1 labels.Selector
+			result2 error
+		})
+	}
+	fake.labelSelectorAsSelectorReturnsOnCall[i] = struct {
+		result1 labels.Selector
+		result2 error
+	}{result1, result2}
+}
+
 func (fake *FakeImpl) ListProfileRecordings(arg1 context.Context, arg2 ...client.ListOption) (*v1alpha1.ProfileRecordingList, error) {
 	fake.listProfileRecordingsMutex.Lock()
 	ret, specificReturn := fake.listProfileRecordingsReturnsOnCall[len(fake.listProfileRecordingsArgsForCall)]
@@ -309,6 +388,8 @@ func (fake *FakeImpl) Invocations() map[string][][]interface{} {
 	defer fake.invocationsMutex.RUnlock()
 	fake.decodePodMutex.RLock()
 	defer fake.decodePodMutex.RUnlock()
+	fake.labelSelectorAsSelectorMutex.RLock()
+	defer fake.labelSelectorAsSelectorMutex.RUnlock()
 	fake.listProfileRecordingsMutex.RLock()
 	defer fake.listProfileRecordingsMutex.RUnlock()
 	fake.setDecoderMutex.RLock()


Test patch:
diff --git a/internal/pkg/webhooks/recording/recording_test.go b/internal/pkg/webhooks/recording/recording_test.go
index 1a35d845f..42770e8d3 100644
--- a/internal/pkg/webhooks/recording/recording_test.go
+++ b/internal/pkg/webhooks/recording/recording_test.go
@@ -18,21 +18,39 @@ package recording
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"net/http"
 	"testing"
 
 	"github.com/go-logr/logr"
 	"github.com/stretchr/testify/require"
+	admissionv1 "k8s.io/api/admission/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/runtime"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 
 	"sigs.k8s.io/security-profiles-operator/api/profilerecording/v1alpha1"
 	"sigs.k8s.io/security-profiles-operator/internal/pkg/webhooks/recording/recordingfakes"
 )
 
-var errTest = errors.New("error")
+var (
+	errTest = errors.New("error")
+	testPod = &corev1.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			GenerateName: "pod-",
+		},
+		Spec: corev1.PodSpec{
+			Containers: []corev1.Container{
+				{
+					Name: "container",
+				},
+			},
+		},
+	}
+)
 
 func TestHandle(t *testing.T) {
 	t.Parallel()
@@ -70,12 +88,195 @@ func TestHandle(t *testing.T) {
 				require.Equal(t, http.StatusBadRequest, int(resp.Result.Code))
 			},
 		},
+		{ // success pod changed
+			prepare: func(mock *recordingfakes.FakeImpl) {
+				mock.ListProfileRecordingsReturns(&v1alpha1.ProfileRecordingList{
+					Items: []v1alpha1.ProfileRecording{
+						{
+							Spec: v1alpha1.ProfileRecordingSpec{
+								Kind: "SeccompProfile",
+							},
+						},
+					},
+				}, nil)
+				mock.DecodePodReturns(testPod.DeepCopy(), nil)
+				mock.LabelSelectorAsSelectorReturns(labels.Everything(), nil)
+			},
+			request: admission.Request{
+				AdmissionRequest: admissionv1.AdmissionRequest{
+					Object: runtime.RawExtension{
+						Raw: func() []byte {
+							b, err := json.Marshal(testPod.DeepCopy())
+							require.Nil(t, err)
+							return b
+						}(),
+					},
+				},
+			},
+			assert: func(resp admission.Response) {
+				require.True(t, resp.AdmissionResponse.Allowed)
+				require.Len(t, resp.Patches, 1)
+			},
+		},
+		{ // success no seccomp profile
+			prepare: func(mock *recordingfakes.FakeImpl) {
+				mock.ListProfileRecordingsReturns(&v1alpha1.ProfileRecordingList{
+					Items: []v1alpha1.ProfileRecording{
+						{
+							Spec: v1alpha1.ProfileRecordingSpec{
+								Kind: "OtherProfile",
+							},
+						},
+					},
+				}, nil)
+				mock.DecodePodReturns(testPod.DeepCopy(), nil)
+			},
+			assert: func(resp admission.Response) {
+				require.True(t, resp.AdmissionResponse.Allowed)
+				require.Empty(t, resp.Patches)
+			},
+		},
+		{ // failure LabelSelectorAsSelector
+			prepare: func(mock *recordingfakes.FakeImpl) {
+				mock.ListProfileRecordingsReturns(&v1alpha1.ProfileRecordingList{
+					Items: []v1alpha1.ProfileRecording{
+						{
+							Spec: v1alpha1.ProfileRecordingSpec{
+								Kind: "SeccompProfile",
+							},
+						},
+					},
+				}, nil)
+				mock.DecodePodReturns(testPod.DeepCopy(), nil)
+				mock.LabelSelectorAsSelectorReturns(nil, errTest)
+			},
+			assert: func(resp admission.Response) {
+				require.Equal(t, http.StatusInternalServerError, int(resp.Result.Code))
+			},
+		},
+		{ // failure UpdateResource
+			prepare: func(mock *recordingfakes.FakeImpl) {
+				mock.ListProfileRecordingsReturns(&v1alpha1.ProfileRecordingList{
+					Items: []v1alpha1.ProfileRecording{
+						{
+							Spec: v1alpha1.ProfileRecordingSpec{
+								Kind: "SeccompProfile",
+							},
+						},
+					},
+				}, nil)
+				mock.DecodePodReturns(testPod.DeepCopy(), nil)
+				mock.LabelSelectorAsSelectorReturns(labels.Everything(), nil)
+				mock.UpdateResourceReturns(errTest)
+			},
+			request: admission.Request{
+				AdmissionRequest: admissionv1.AdmissionRequest{
+					Object: runtime.RawExtension{
+						Raw: func() []byte {
+							b, err := json.Marshal(testPod.DeepCopy())
+							require.Nil(t, err)
+							return b
+						}(),
+					},
+				},
+			},
+			assert: func(resp admission.Response) {
+				require.Equal(t, http.StatusInternalServerError, int(resp.Result.Code))
+			},
+		},
+		{ // success pod already tracked
+			prepare: func(mock *recordingfakes.FakeImpl) {
+				mock.ListProfileRecordingsReturns(&v1alpha1.ProfileRecordingList{
+					Items: []v1alpha1.ProfileRecording{
+						{
+							Spec: v1alpha1.ProfileRecordingSpec{
+								Kind: "SeccompProfile",
+							},
+						},
+					},
+				}, nil)
+				pod := testPod.DeepCopy()
+				pod.Annotations = map[string]string{
+					"io.containers.trace-syscall/container": "of:/some/path.json",
+				}
+				mock.DecodePodReturns(pod, nil)
+				mock.LabelSelectorAsSelectorReturns(labels.Everything(), nil)
+			},
+			request: admission.Request{
+				AdmissionRequest: admissionv1.AdmissionRequest{
+					Object: runtime.RawExtension{
+						Raw: func() []byte {
+							b, err := json.Marshal(testPod.DeepCopy())
+							require.Nil(t, err)
+							return b
+						}(),
+					},
+				},
+			},
+			assert: func(resp admission.Response) {
+				require.True(t, resp.AdmissionResponse.Allowed)
+				require.Len(t, resp.Patches, 0)
+			},
+		},
+		{ // success pod deleted
+			prepare: func(mock *recordingfakes.FakeImpl) {
+				mock.ListProfileRecordingsReturns(&v1alpha1.ProfileRecordingList{
+					Items: []v1alpha1.ProfileRecording{
+						{
+							Spec: v1alpha1.ProfileRecordingSpec{
+								Kind: "SeccompProfile",
+							},
+							Status: v1alpha1.ProfileRecordingStatus{
+								ActiveWorkloads: []string{"1", "2", "3"},
+							},
+						},
+					},
+				}, nil)
+				mock.DecodePodReturns(testPod.DeepCopy(), nil)
+				mock.LabelSelectorAsSelectorReturns(labels.Everything(), nil)
+			},
+			request: admission.Request{
+				AdmissionRequest: admissionv1.AdmissionRequest{
+					Operation: admissionv1.Delete,
+				},
+			},
+			assert: func(resp admission.Response) {
+				require.True(t, resp.AdmissionResponse.Allowed)
+			},
+		},
+		{ // failure pod deleted on UpdateResource
+			prepare: func(mock *recordingfakes.FakeImpl) {
+				mock.ListProfileRecordingsReturns(&v1alpha1.ProfileRecordingList{
+					Items: []v1alpha1.ProfileRecording{
+						{
+							Spec: v1alpha1.ProfileRecordingSpec{
+								Kind: "SeccompProfile",
+							},
+							Status: v1alpha1.ProfileRecordingStatus{
+								ActiveWorkloads: []string{"1", "2", "3"},
+							},
+						},
+					},
+				}, nil)
+				mock.DecodePodReturns(testPod.DeepCopy(), nil)
+				mock.LabelSelectorAsSelectorReturns(labels.Everything(), nil)
+				mock.UpdateResourceReturns(errTest)
+			},
+			request: admission.Request{
+				AdmissionRequest: admissionv1.AdmissionRequest{
+					Operation: admissionv1.Delete,
+				},
+			},
+			assert: func(resp admission.Response) {
+				require.Equal(t, http.StatusInternalServerError, int(resp.Result.Code))
+			},
+		},
 	} {
 		mock := &recordingfakes.FakeImpl{}
 		tc.prepare(mock)
 
 		recorder := podSeccompRecorder{impl: mock, log: logr.Discard()}
-		resp := recorder.Handle(context.Background(), admission.Request{})
+		resp := recorder.Handle(context.Background(), tc.request)
 		tc.assert(resp)
 	}
 }
diff --git a/test/e2e_test.go b/test/e2e_test.go
index f642e8c91..6e894c4b3 100644
--- a/test/e2e_test.go
+++ b/test/e2e_test.go
@@ -302,7 +302,7 @@ func (e *e2e) getSELinuxPolicyUsage(policy string) string {
 	ns := e.getCurrentContextNamespace(defaultNamespace)
 	// This describes the usage string, which is not necessarily
 	// the name of the policy in the node
-	return e.kubectl("get", "selinuxpolicy", "-n", ns, policy, "-o", "jsonpath={.status.usage}")
+	return e.kubectl("get", "selinuxprofile", "-n", ns, policy, "-o", "jsonpath={.status.usage}")
 }
 
 func (e *e2e) sliceContainsString(slice []string, s string) bool {
diff --git a/test/tc_selinux_base_usage_test.go b/test/tc_selinux_base_usage_test.go
index a5b262c9d..c031368c1 100644
--- a/test/tc_selinux_base_usage_test.go
+++ b/test/tc_selinux_base_usage_test.go
@@ -56,7 +56,7 @@ spec:
 
 	const errorloggerPolicy = `
 apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
-kind: SelinuxPolicy
+kind: SelinuxProfile
 metadata:
   name: errorlogger
 spec:
@@ -75,7 +75,7 @@ spec:
 
 	// Let's wait for the policy to be processed
 	e.kubectl("wait", "--timeout", defaultSelinuxOpTimeout,
-		"--for", "condition=ready", "selinuxpolicy", "errorlogger")
+		"--for", "condition=ready", "selinuxprofile", "errorlogger")
 
 	rawPolicyName := e.getSELinuxPolicyName("errorlogger")
 
@@ -94,7 +94,7 @@ spec:
 
 		if missingPolName != "" {
 			if i == maxNodeIterations-1 {
-				e.Failf("The SelinuxPolicy errorlogger wasn't found in the %s node with the name %s",
+				e.Failf("The SelinuxProfile errorlogger wasn't found in the %s node with the name %s",
 					missingPolName, rawPolicyName)
 			} else {
 				e.logf("the policy was stil present, trying again")
@@ -123,7 +123,7 @@ spec:
 	e.kubectl("delete", "pod", "errorlogger")
 
 	e.logf("removing policy")
-	e.kubectl("delete", "selinuxpolicy", "errorlogger")
+	e.kubectl("delete", "selinuxprofile", "errorlogger")
 
 	e.logf("assert policy was removed")
 	for i := 0; i < maxNodeIterations; i++ {
@@ -139,7 +139,7 @@ spec:
 
 		if nodeHasPolName != "" {
 			if i == maxNodeIterations-1 {
-				e.Failf("The SelinuxPolicy errorlogger should have been removed from %s node", nodeHasPolName)
+				e.Failf("The SelinuxProfile errorlogger should have been removed from %s node", nodeHasPolName)
 			} else {
 				e.logf("the policy was stil present, trying again")
 				time.Sleep(sleepBetweenIterations)