Repository: kubernetes-sigs/security-profiles-operator
Pull request #1088 (2022-08-15 10:31:27)

Roll back problematic pod labeling feature
#### What type of PR is this?

/kind cleanup
/kind feature

#### What this PR does / why we need it:

Some time ago I introduced a feature for the SPO to label denials for
pods. While this seemed like a good idea at the time, it introduces too
much privileges for te SPOd (update and patch all pods).

While there hasn't been any security incidents reported for the SPOd,
the drawbacks of giving such privileges are more critical than the
features the labeling would have enabled. So, let's get rid of this
feature and revisit the problem another time.

This fully removes the flag as there is no documented usage of the feature.

#### Which issue(s) this PR fixes:

None

#### Does this PR have test?

The test was removed.

#### Special notes for your reviewer:

#### Does this PR introduce a user-facing change?

```release-note
Pod denials labeling feature was removed.
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1088#" title="Author self-approved">JAORMX</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [JAORMX]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
k8s-ci-robot: @JAORMX: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-unit | 2c08afdb125ec26e6707177802a04ebc40c828f8 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1088/pull-security-profiles-operator-test-unit/1559125616513519616) | true | `/test pull-security-profiles-operator-test-unit`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1088). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-unit | 2c08afdb125ec26e6707177802a04ebc40c828f8 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1088/pull-security-profiles-operator-test-unit/1559125616513519616) | true | `/test pull-security-profiles-operator-test-unit`
pull-security-profiles-operator-verify | 2c08afdb125ec26e6707177802a04ebc40c828f8 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1088/pull-security-profiles-operator-verify/1559125616475770880) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1088). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-unit | 2c08afdb125ec26e6707177802a04ebc40c828f8 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1088/pull-security-profiles-operator-test-unit/1559125616513519616) | true | `/test pull-security-profiles-operator-test-unit`
pull-security-profiles-operator-verify | ea9e50ae0e5e13307bbfa7ee3e2dbcae23559789 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1088/pull-security-profiles-operator-verify/1559129472509153280) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1088). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
codecov-commenter: # [Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/1088?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) Report
> Merging [#1088](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/1088?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) (300b5b8) into [main](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/commit/e259f4ff1a2e8b1914d87ccb26321fbb6a4b8b4f?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) (e259f4f) will **increase** coverage by `0.51%`.
> The diff coverage is `100.00%`.

> :exclamation: Current head 300b5b8 differs from pull request most recent head ea9e50a. Consider uploading reports for the commit ea9e50a to get more accurate results

```diff
@@            Coverage Diff             @@
##             main    #1088      +/-   ##
==========================================
+ Coverage   50.13%   50.65%   +0.51%     
==========================================
  Files          42       42              
  Lines        4789     4740      -49     
==========================================
  Hits         2401     2401              
+ Misses       2309     2262      -47     
+ Partials       79       77       -2     
```

k8s-ci-robot: @JAORMX: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 43d63578154fede524d2858a324cbaa067fedba8 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1088/pull-security-profiles-operator-test-e2e/1559130892968923136) | true | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1088). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @JAORMX: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 3f9e1284abe90366a67d90605e3de1cb55fb03b6 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1088/pull-security-profiles-operator-test-e2e/1559434111351787520) | true | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1088). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
jhrozek: /test pull-security-profiles-operator-test-e2e
k8s-ci-robot: @JAORMX: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 3f9e1284abe90366a67d90605e3de1cb55fb03b6 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1088/pull-security-profiles-operator-test-e2e/1559443527971115008) | true | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1088). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AJAORMX). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
JAORMX: /retest
jhrozek: So I'm fine removing this functionality (AFAIK nothing and nobody uses it now), but I'd like to discuss alternatives, because I think it's something users will ask for.

The use-case I care about the most is:
 - a developer records an initial policy in CI
 - an SRE deploys the app and the policy. Both acknowledge that the initial policy version is not 100% correct and want to find out AVCs/seccomp denials
 - so far I was thinking about adding a "permissive" flag to be added to the profiles which would change the `defaultAction` to `SCMP_ACT_LOG` for seccomp profiles and inherit from `typepermissive process` for SELinux policies.
 - this would produce logs, then the question is how to gather them and there we'd probably do what your approach did, but maybe label the profiles instead of the workloads? I think this would be more palatable from the RBAC perspective. Maybe we could issue events, too, not sure what would be best for SREs in the end.
JAORMX: @jhrozek I was actually thinking about doing events instead. But struggled to introduce them without adding a lot of extra complexity to the code-base. We might need to do some refactoring.

Patch:
diff --git a/api/spod/v1alpha1/spod_types.go b/api/spod/v1alpha1/spod_types.go
index 4927c4bb0..afec1aad2 100644
--- a/api/spod/v1alpha1/spod_types.go
+++ b/api/spod/v1alpha1/spod_types.go
@@ -69,10 +69,6 @@ type SPODSpec struct {
 	// tells the operator whether or not to enable AppArmor support for this
 	// SPOD instance.
 	EnableAppArmor bool `json:"enableAppArmor,omitempty"`
-	// tells the operator whether or not to apply labels to pods that present
-	// security policy-related denials. Note that this will be done cluster-wide.
-	// Note that this currently requires the log enricher to be enabled.
-	LabelPodDenials bool `json:"labelPodDenials,omitempty"`
 	// If specified, the SPOD's tolerations.
 	// +optional
 	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`
diff --git a/bundle/manifests/security-profiles-operator.x-k8s.io_securityprofilesoperatordaemons.yaml b/bundle/manifests/security-profiles-operator.x-k8s.io_securityprofilesoperatordaemons.yaml
index ab2f6b39f..dccb9c606 100644
--- a/bundle/manifests/security-profiles-operator.x-k8s.io_securityprofilesoperatordaemons.yaml
+++ b/bundle/manifests/security-profiles-operator.x-k8s.io_securityprofilesoperatordaemons.yaml
@@ -82,12 +82,6 @@ spec:
                   as bpf-recorder to retrieve the container ID for a process ID. This
                   can be helpful for nested environments, for example when using "kind".
                 type: string
-              labelPodDenials:
-                description: tells the operator whether or not to apply labels to
-                  pods that present security policy-related denials. Note that this
-                  will be done cluster-wide. Note that this currently requires the
-                  log enricher to be enabled.
-                type: boolean
               selinuxOptions:
                 description: Defines options specific to the SELinux functionality
                   of the SecurityProfilesOperator
diff --git a/bundle/manifests/spod_rbac.authorization.k8s.io_v1_clusterrole.yaml b/bundle/manifests/spod_rbac.authorization.k8s.io_v1_clusterrole.yaml
index 9a516f72f..c7d5fa66c 100644
--- a/bundle/manifests/spod_rbac.authorization.k8s.io_v1_clusterrole.yaml
+++ b/bundle/manifests/spod_rbac.authorization.k8s.io_v1_clusterrole.yaml
@@ -43,8 +43,6 @@ rules:
   verbs:
   - get
   - list
-  - patch
-  - update
   - watch
 - apiGroups:
   - security-profiles-operator.x-k8s.io
diff --git a/cmd/security-profiles-operator/main.go b/cmd/security-profiles-operator/main.go
index 38d29b68b..096d94301 100644
--- a/cmd/security-profiles-operator/main.go
+++ b/cmd/security-profiles-operator/main.go
@@ -66,7 +66,6 @@ const (
 	jsonFlag           string = "json"
 	selinuxFlag        string = "with-selinux"
 	apparmorFlag       string = "with-apparmor"
-	labelDenialsFlag   string = "label-denials"
 	webhookFlag        string = "webhook"
 	defaultWebhookPort int    = 9443
 )
@@ -188,13 +187,6 @@ func main() {
 			Name:    "log-enricher",
 			Aliases: []string{"l"},
 			Usage:   "run the audit's log enricher",
-			Flags: []cli.Flag{
-				&cli.BoolFlag{
-					Name:  labelDenialsFlag,
-					Usage: "whether to label problematic pods or not",
-					Value: false,
-				},
-			},
 			Action: func(ctx *cli.Context) error {
 				return runLogEnricher(ctx, info)
 			},
@@ -468,7 +460,7 @@ func runLogEnricher(clictx *cli.Context, info *version.Info) error {
 	const component = "log-enricher"
 	printInfo(component, info)
 
-	e, err := enricher.New(ctrl.Log.WithName(component), clictx.Bool(labelDenialsFlag))
+	e, err := enricher.New(ctrl.Log.WithName(component))
 	if err != nil {
 		return fmt.Errorf("building log enricher: %w", err)
 	}
diff --git a/deploy/base-crds/crds/securityprofilesoperatordaemon.yaml b/deploy/base-crds/crds/securityprofilesoperatordaemon.yaml
index b23458ea0..131b387f1 100644
--- a/deploy/base-crds/crds/securityprofilesoperatordaemon.yaml
+++ b/deploy/base-crds/crds/securityprofilesoperatordaemon.yaml
@@ -80,12 +80,6 @@ spec:
                   as bpf-recorder to retrieve the container ID for a process ID. This
                   can be helpful for nested environments, for example when using "kind".
                 type: string
-              labelPodDenials:
-                description: tells the operator whether or not to apply labels to
-                  pods that present security policy-related denials. Note that this
-                  will be done cluster-wide. Note that this currently requires the
-                  log enricher to be enabled.
-                type: boolean
               selinuxOptions:
                 description: Defines options specific to the SELinux functionality
                   of the SecurityProfilesOperator
diff --git a/deploy/base/role.yaml b/deploy/base/role.yaml
index 4b5041bc6..3d635af30 100644
--- a/deploy/base/role.yaml
+++ b/deploy/base/role.yaml
@@ -287,8 +287,6 @@ rules:
   verbs:
   - get
   - list
-  - patch
-  - update
   - watch
 - apiGroups:
   - security-profiles-operator.x-k8s.io
diff --git a/deploy/helm/crds/crds.yaml b/deploy/helm/crds/crds.yaml
index 32f8ff847..c2fba8dcd 100644
--- a/deploy/helm/crds/crds.yaml
+++ b/deploy/helm/crds/crds.yaml
@@ -599,12 +599,6 @@ spec:
                   as bpf-recorder to retrieve the container ID for a process ID. This
                   can be helpful for nested environments, for example when using "kind".
                 type: string
-              labelPodDenials:
-                description: tells the operator whether or not to apply labels to
-                  pods that present security policy-related denials. Note that this
-                  will be done cluster-wide. Note that this currently requires the
-                  log enricher to be enabled.
-                type: boolean
               selinuxOptions:
                 description: Defines options specific to the SELinux functionality
                   of the SecurityProfilesOperator
diff --git a/deploy/helm/templates/static-resources.yaml b/deploy/helm/templates/static-resources.yaml
index cea2c9b12..5636baf48 100644
--- a/deploy/helm/templates/static-resources.yaml
+++ b/deploy/helm/templates/static-resources.yaml
@@ -326,8 +326,6 @@ rules:
   verbs:
   - get
   - list
-  - patch
-  - update
   - watch
 - apiGroups:
   - security-profiles-operator.x-k8s.io
diff --git a/deploy/namespace-operator.yaml b/deploy/namespace-operator.yaml
index fc5ab306b..ea9b5e6cc 100644
--- a/deploy/namespace-operator.yaml
+++ b/deploy/namespace-operator.yaml
@@ -599,12 +599,6 @@ spec:
                   as bpf-recorder to retrieve the container ID for a process ID. This
                   can be helpful for nested environments, for example when using "kind".
                 type: string
-              labelPodDenials:
-                description: tells the operator whether or not to apply labels to
-                  pods that present security policy-related denials. Note that this
-                  will be done cluster-wide. Note that this currently requires the
-                  log enricher to be enabled.
-                type: boolean
               selinuxOptions:
                 description: Defines options specific to the SELinux functionality
                   of the SecurityProfilesOperator
@@ -1410,8 +1404,6 @@ rules:
   verbs:
   - get
   - list
-  - patch
-  - update
   - watch
 - apiGroups:
   - security-profiles-operator.x-k8s.io
diff --git a/deploy/openshift-dev.yaml b/deploy/openshift-dev.yaml
index 5cfda0edd..69f3b8830 100644
--- a/deploy/openshift-dev.yaml
+++ b/deploy/openshift-dev.yaml
@@ -599,12 +599,6 @@ spec:
                   as bpf-recorder to retrieve the container ID for a process ID. This
                   can be helpful for nested environments, for example when using "kind".
                 type: string
-              labelPodDenials:
-                description: tells the operator whether or not to apply labels to
-                  pods that present security policy-related denials. Note that this
-                  will be done cluster-wide. Note that this currently requires the
-                  log enricher to be enabled.
-                type: boolean
               selinuxOptions:
                 description: Defines options specific to the SELinux functionality
                   of the SecurityProfilesOperator
@@ -1410,8 +1404,6 @@ rules:
   verbs:
   - get
   - list
-  - patch
-  - update
   - watch
 - apiGroups:
   - security-profiles-operator.x-k8s.io
diff --git a/deploy/operator.yaml b/deploy/operator.yaml
index ae81234c0..93d4537cb 100644
--- a/deploy/operator.yaml
+++ b/deploy/operator.yaml
@@ -599,12 +599,6 @@ spec:
                   as bpf-recorder to retrieve the container ID for a process ID. This
                   can be helpful for nested environments, for example when using "kind".
                 type: string
-              labelPodDenials:
-                description: tells the operator whether or not to apply labels to
-                  pods that present security policy-related denials. Note that this
-                  will be done cluster-wide. Note that this currently requires the
-                  log enricher to be enabled.
-                type: boolean
               selinuxOptions:
                 description: Defines options specific to the SELinux functionality
                   of the SecurityProfilesOperator
@@ -1410,8 +1404,6 @@ rules:
   verbs:
   - get
   - list
-  - patch
-  - update
   - watch
 - apiGroups:
   - security-profiles-operator.x-k8s.io
diff --git a/deploy/webhook-operator.yaml b/deploy/webhook-operator.yaml
index 13dd06e01..4b143fcda 100644
--- a/deploy/webhook-operator.yaml
+++ b/deploy/webhook-operator.yaml
@@ -774,12 +774,6 @@ spec:
                   as bpf-recorder to retrieve the container ID for a process ID. This
                   can be helpful for nested environments, for example when using "kind".
                 type: string
-              labelPodDenials:
-                description: tells the operator whether or not to apply labels to
-                  pods that present security policy-related denials. Note that this
-                  will be done cluster-wide. Note that this currently requires the
-                  log enricher to be enabled.
-                type: boolean
               selinuxOptions:
                 description: Defines options specific to the SELinux functionality
                   of the SecurityProfilesOperator
@@ -1547,8 +1541,6 @@ rules:
   verbs:
   - get
   - list
-  - patch
-  - update
   - watch
 - apiGroups:
   - security-profiles-operator.x-k8s.io
diff --git a/go.mod b/go.mod
index 088934862..34053469f 100644
--- a/go.mod
+++ b/go.mod
@@ -21,7 +21,7 @@ require (
 	github.com/prometheus/client_model v0.2.0
 	github.com/seccomp/libseccomp-golang v0.9.2-0.20210429002308-3879420cc921
 	github.com/stretchr/testify v1.8.0
-	github.com/urfave/cli/v2 v2.11.1
+	github.com/urfave/cli/v2 v2.11.2
 	golang.org/x/net v0.0.0-20220708220712-1185a9018129
 	golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f
 	google.golang.org/grpc v1.48.0
diff --git a/go.sum b/go.sum
index dd523065a..b3413e5c4 100644
--- a/go.sum
+++ b/go.sum
@@ -1356,8 +1356,8 @@ github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtX
 github.com/urfave/cli v1.22.2/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
 github.com/urfave/cli v1.22.4/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
 github.com/urfave/cli/v2 v2.2.0/go.mod h1:SE9GqnLQmjVa0iPEY0f1w3ygNIYcIJ0OKPMoW2caLfQ=
-github.com/urfave/cli/v2 v2.11.1 h1:UKK6SP7fV3eKOefbS87iT9YHefv7iB/53ih6e+GNAsE=
-github.com/urfave/cli/v2 v2.11.1/go.mod h1:f8iq5LtQ/bLxafbdBSLPPNsgaW0l/2fYYEHhAyPlwvo=
+github.com/urfave/cli/v2 v2.11.2 h1:FVfNg4m3vbjbBpLYxW//WjxUoHvJ9TlppXcqY9Q9ZfA=
+github.com/urfave/cli/v2 v2.11.2/go.mod h1:f8iq5LtQ/bLxafbdBSLPPNsgaW0l/2fYYEHhAyPlwvo=
 github.com/uudashr/gocognit v1.0.5/go.mod h1:wgYz0mitoKOTysqxTDMOUXg+Jb5SvtihkfmugIZYpEA=
 github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
 github.com/valyala/fasthttp v1.30.0/go.mod h1:2rsYD01CKFrjjsvFxx75KlEUNpWNBY9JWD3K/7o2Cus=
diff --git a/internal/pkg/daemon/enricher/container.go b/internal/pkg/daemon/enricher/container.go
index e2d7de4bf..992320c47 100644
--- a/internal/pkg/daemon/enricher/container.go
+++ b/internal/pkg/daemon/enricher/container.go
@@ -21,12 +21,10 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/go-logr/logr"
 	"github.com/jellydator/ttlcache/v3"
 	"golang.org/x/net/context"
 	"golang.org/x/sync/errgroup"
 	v1 "k8s.io/api/core/v1"
-	kerrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/util/wait"
 
 	"sigs.k8s.io/security-profiles-operator/internal/pkg/config"
@@ -40,8 +38,6 @@ const (
 	backoffDuration  = 500 * time.Millisecond
 	backoffFactor    = 1.5
 	backoffSteps     = 10
-
-	problematicContainerLabelKey = "spo.x-k8s.io/had-denials"
 )
 
 var errContainerIDEmpty = errors.New("container ID is empty")
@@ -49,7 +45,7 @@ var errContainerIDEmpty = errors.New("container ID is empty")
 // NOTE(jaosorior): Should this actually be namespace-scoped?
 //
 // Cluster scoped
-// +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list;watch;patch;update
+// +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list;watch
 
 func (e *Enricher) getContainerInfo(
 	nodeName, targetContainerID string,
@@ -156,12 +152,6 @@ func (e *Enricher) populateCacheEntryForContainer(
 				RecordProfile: recordProfile,
 			}
 
-			if e.labelDenials && rawContainerID == targetContainerID {
-				e.logger.Info("labeling problematic container", "containerID", containerID,
-					"podNamespace", pod.Namespace, "podName", pod.Name)
-				e.labelPodDenials(context.TODO(), info.ContainerName, pod.DeepCopy(), e.logger)
-			}
-
 			// Update the cache
 			e.infoCache.Set(rawContainerID, info, ttlcache.DefaultTTL)
 		}
@@ -187,36 +177,3 @@ func (e *Enricher) handleContainerIDEmpty(podName, containerName string, contain
 		containerStatus.State,
 	)
 }
-
-func (e *Enricher) labelPodDenials(
-	ctx context.Context, containerName string, pod *v1.Pod, l logr.Logger,
-) {
-	// verify if we need to label or if the label is already there
-	if labels := pod.GetLabels(); labels != nil {
-		if _, ok := labels[problematicContainerLabelKey]; ok {
-			return
-		}
-	}
-
-	containerRetryBackoff := wait.Backoff{
-		Duration: backoffDuration,
-		Factor:   backoffFactor,
-		Steps:    backoffSteps,
-	}
-
-	if err := util.RetryEx(
-		&containerRetryBackoff,
-		func() (retryErr error) {
-			return e.impl.LabelPodDenials(ctx, e.clientset, pod)
-		},
-		func(inErr error) bool {
-			return !kerrors.IsNotFound(inErr)
-		},
-	); err != nil {
-		l.Error(
-			err, "unable to patch container to mark it as problematic",
-			"pod.Namespace", pod.GetNamespace(), "pod.Name", pod.GetName(),
-			"containerName", containerName,
-		)
-	}
-}
diff --git a/internal/pkg/daemon/enricher/enricher.go b/internal/pkg/daemon/enricher/enricher.go
index ea5002d4b..66c05c14d 100644
--- a/internal/pkg/daemon/enricher/enricher.go
+++ b/internal/pkg/daemon/enricher/enricher.go
@@ -64,11 +64,10 @@ type Enricher struct {
 	avcs             sync.Map
 	auditLineCache   *ttlcache.Cache[string, []*types.AuditLine]
 	clientset        kubernetes.Interface
-	labelDenials     bool
 }
 
 // New returns a new Enricher instance.
-func New(logger logr.Logger, labelDenials bool, impls ...impl) (*Enricher, error) {
+func New(logger logr.Logger, impls ...impl) (*Enricher, error) {
 	var effectiveimpl impl
 	if len(impls) == 0 {
 		effectiveimpl = &defaultImpl{}
@@ -106,18 +105,13 @@ func New(logger logr.Logger, labelDenials bool, impls ...impl) (*Enricher, error
 			// if/when the cache is full.
 			ttlcache.WithDisableTouchOnHit[string, []*types.AuditLine](),
 		),
-		labelDenials: labelDenials,
-		clientset:    clientset,
+		clientset: clientset,
 	}, nil
 }
 
 // Run the log-enricher to scrap audit logs and enrich them with
 // Kubernetes data (namespace, pod and container).
 func (e *Enricher) Run() error {
-	if e.labelDenials {
-		e.logger.Info("Labeling problematic containers is enabled")
-	}
-
 	e.logger.Info(fmt.Sprintf("Setting up caches with expiry of %v", defaultCacheTimeout))
 	go e.containerIDCache.Start()
 	go e.infoCache.Start()
diff --git a/internal/pkg/daemon/enricher/enricherfakes/fake_impl.go b/internal/pkg/daemon/enricher/enricherfakes/fake_impl.go
index f91924c22..f93d4c47f 100644
--- a/internal/pkg/daemon/enricher/enricherfakes/fake_impl.go
+++ b/internal/pkg/daemon/enricher/enricherfakes/fake_impl.go
@@ -147,19 +147,6 @@ type FakeImpl struct {
 		result1 *rest.Config
 		result2 error
 	}
-	LabelPodDenialsStub        func(context.Context, kubernetes.Interface, *v1.Pod) error
-	labelPodDenialsMutex       sync.RWMutex
-	labelPodDenialsArgsForCall []struct {
-		arg1 context.Context
-		arg2 kubernetes.Interface
-		arg3 *v1.Pod
-	}
-	labelPodDenialsReturns struct {
-		result1 error
-	}
-	labelPodDenialsReturnsOnCall map[int]struct {
-		result1 error
-	}
 	LinesStub        func(*tail.Tail) chan *tail.Line
 	linesMutex       sync.RWMutex
 	linesArgsForCall []struct {
@@ -853,69 +840,6 @@ func (fake *FakeImpl) InClusterConfigReturnsOnCall(i int, result1 *rest.Config,
 	}{result1, result2}
 }
 
-func (fake *FakeImpl) LabelPodDenials(arg1 context.Context, arg2 kubernetes.Interface, arg3 *v1.Pod) error {
-	fake.labelPodDenialsMutex.Lock()
-	ret, specificReturn := fake.labelPodDenialsReturnsOnCall[len(fake.labelPodDenialsArgsForCall)]
-	fake.labelPodDenialsArgsForCall = append(fake.labelPodDenialsArgsForCall, struct {
-		arg1 context.Context
-		arg2 kubernetes.Interface
-		arg3 *v1.Pod
-	}{arg1, arg2, arg3})
-	stub := fake.LabelPodDenialsStub
-	fakeReturns := fake.labelPodDenialsReturns
-	fake.recordInvocation("LabelPodDenials", []interface{}{arg1, arg2, arg3})
-	fake.labelPodDenialsMutex.Unlock()
-	if stub != nil {
-		return stub(arg1, arg2, arg3)
-	}
-	if specificReturn {
-		return ret.result1
-	}
-	return fakeReturns.result1
-}
-
-func (fake *FakeImpl) LabelPodDenialsCallCount() int {
-	fake.labelPodDenialsMutex.RLock()
-	defer fake.labelPodDenialsMutex.RUnlock()
-	return len(fake.labelPodDenialsArgsForCall)
-}
-
-func (fake *FakeImpl) LabelPodDenialsCalls(stub func(context.Context, kubernetes.Interface, *v1.Pod) error) {
-	fake.labelPodDenialsMutex.Lock()
-	defer fake.labelPodDenialsMutex.Unlock()
-	fake.LabelPodDenialsStub = stub
-}
-
-func (fake *FakeImpl) LabelPodDenialsArgsForCall(i int) (context.Context, kubernetes.Interface, *v1.Pod) {
-	fake.labelPodDenialsMutex.RLock()
-	defer fake.labelPodDenialsMutex.RUnlock()
-	argsForCall := fake.labelPodDenialsArgsForCall[i]
-	return argsForCall.arg1, argsForCall.arg2, argsForCall.arg3
-}
-
-func (fake *FakeImpl) LabelPodDenialsReturns(result1 error) {
-	fake.labelPodDenialsMutex.Lock()
-	defer fake.labelPodDenialsMutex.Unlock()
-	fake.LabelPodDenialsStub = nil
-	fake.labelPodDenialsReturns = struct {
-		result1 error
-	}{result1}
-}
-
-func (fake *FakeImpl) LabelPodDenialsReturnsOnCall(i int, result1 error) {
-	fake.labelPodDenialsMutex.Lock()
-	defer fake.labelPodDenialsMutex.Unlock()
-	fake.LabelPodDenialsStub = nil
-	if fake.labelPodDenialsReturnsOnCall == nil {
-		fake.labelPodDenialsReturnsOnCall = make(map[int]struct {
-			result1 error
-		})
-	}
-	fake.labelPodDenialsReturnsOnCall[i] = struct {
-		result1 error
-	}{result1}
-}
-
 func (fake *FakeImpl) Lines(arg1 *tail.Tail) chan *tail.Line {
 	fake.linesMutex.Lock()
 	ret, specificReturn := fake.linesReturnsOnCall[len(fake.linesArgsForCall)]
@@ -1570,8 +1494,6 @@ func (fake *FakeImpl) Invocations() map[string][][]interface{} {
 	defer fake.getenvMutex.RUnlock()
 	fake.inClusterConfigMutex.RLock()
 	defer fake.inClusterConfigMutex.RUnlock()
-	fake.labelPodDenialsMutex.RLock()
-	defer fake.labelPodDenialsMutex.RUnlock()
 	fake.linesMutex.RLock()
 	defer fake.linesMutex.RUnlock()
 	fake.listPodsMutex.RLock()
diff --git a/internal/pkg/daemon/enricher/impl.go b/internal/pkg/daemon/enricher/impl.go
index 1b6aad88e..eab44448e 100644
--- a/internal/pkg/daemon/enricher/impl.go
+++ b/internal/pkg/daemon/enricher/impl.go
@@ -50,7 +50,6 @@ type impl interface {
 	InClusterConfig() (*rest.Config, error)
 	NewForConfig(c *rest.Config) (*kubernetes.Clientset, error)
 	ListPods(ctx context.Context, c kubernetes.Interface, nodeName string) (*v1.PodList, error)
-	LabelPodDenials(ctx context.Context, c kubernetes.Interface, pod *v1.Pod) error
 	AuditInc(client api.MetricsClient) (api.Metrics_AuditIncClient, error)
 	SendMetric(client api.Metrics_AuditIncClient, in *api.AuditRequest) error
 	Listen(string, string) (net.Listener, error)
@@ -111,21 +110,6 @@ func (d *defaultImpl) ListPods(
 	})
 }
 
-func (d *defaultImpl) LabelPodDenials(
-	ctx context.Context, c kubernetes.Interface, pod *v1.Pod,
-) error {
-	labels := pod.GetLabels()
-	if labels == nil {
-		labels = make(map[string]string)
-	}
-	labels[problematicContainerLabelKey] = ""
-	pod.SetLabels(labels)
-	_, err := c.CoreV1().Pods(pod.GetNamespace()).Update(
-		ctx, pod, metav1.UpdateOptions{},
-	)
-	return err
-}
-
 func (d *defaultImpl) AuditInc(
 	client api.MetricsClient,
 ) (api.Metrics_AuditIncClient, error) {
diff --git a/internal/pkg/manager/spod/spod_controller.go b/internal/pkg/manager/spod/spod_controller.go
index 8de94d66b..629b4337f 100644
--- a/internal/pkg/manager/spod/spod_controller.go
+++ b/internal/pkg/manager/spod/spod_controller.go
@@ -504,10 +504,6 @@ func (r *ReconcileSPOd) getConfiguredSPOd(
 		ctr := r.baseSPOd.Spec.Template.Spec.Containers[bindata.ContainerIDLogEnricher]
 		ctr.Image = image
 
-		if cfg.Spec.LabelPodDenials {
-			ctr.Args = []string{"log-enricher", "--label-denials"}
-		}
-
 		if useCustomHostProc {
 			ctr.VolumeMounts = append(ctr.VolumeMounts, mount)
 		}
diff --git a/vendor/github.com/urfave/cli/v2/app.go b/vendor/github.com/urfave/cli/v2/app.go
index 7e64c2d9f..0b3f45cfd 100644
--- a/vendor/github.com/urfave/cli/v2/app.go
+++ b/vendor/github.com/urfave/cli/v2/app.go
@@ -275,7 +275,9 @@ func (a *App) RunContext(ctx context.Context, arguments []string) (err error) {
 	cCtx := NewContext(a, set, &Context{Context: ctx})
 	if nerr != nil {
 		_, _ = fmt.Fprintln(a.Writer, nerr)
-		_ = ShowAppHelp(cCtx)
+		if !a.HideHelp {
+			_ = ShowAppHelp(cCtx)
+		}
 		return nerr
 	}
 	cCtx.shellComplete = shellComplete
@@ -296,10 +298,24 @@ func (a *App) RunContext(ctx context.Context, arguments []string) (err error) {
 				fmt.Fprintf(a.Writer, suggestion)
 			}
 		}
-		_ = ShowAppHelp(cCtx)
+		if !a.HideHelp {
+			_ = ShowAppHelp(cCtx)
+		}
 		return err
 	}
 
+	if a.After != nil {
+		defer func() {
+			if afterErr := a.After(cCtx); afterErr != nil {
+				if err != nil {
+					err = newMultiError(err, afterErr)
+				} else {
+					err = afterErr
+				}
+			}
+		}()
+	}
+
 	if !a.HideHelp && checkHelp(cCtx) {
 		_ = ShowAppHelp(cCtx)
 		return nil
@@ -316,18 +332,6 @@ func (a *App) RunContext(ctx context.Context, arguments []string) (err error) {
 		return cerr
 	}
 
-	if a.After != nil {
-		defer func() {
-			if afterErr := a.After(cCtx); afterErr != nil {
-				if err != nil {
-					err = newMultiError(err, afterErr)
-				} else {
-					err = afterErr
-				}
-			}
-		}()
-	}
-
 	if a.Before != nil {
 		beforeErr := a.Before(cCtx)
 		if beforeErr != nil {
diff --git a/vendor/github.com/urfave/cli/v2/command.go b/vendor/github.com/urfave/cli/v2/command.go
index 2cafd8e0e..13b79de46 100644
--- a/vendor/github.com/urfave/cli/v2/command.go
+++ b/vendor/github.com/urfave/cli/v2/command.go
@@ -125,7 +125,9 @@ func (c *Command) Run(ctx *Context) (err error) {
 				fmt.Fprintf(cCtx.App.Writer, suggestion)
 			}
 		}
-		_ = ShowCommandHelp(cCtx, c.Name)
+		if !c.HideHelp {
+			_ = ShowCommandHelp(cCtx, c.Name)
+		}
 		return err
 	}
 
@@ -135,7 +137,9 @@ func (c *Command) Run(ctx *Context) (err error) {
 
 	cerr := cCtx.checkRequiredFlags(c.Flags)
 	if cerr != nil {
-		_ = ShowCommandHelp(cCtx, c.Name)
+		if !c.HideHelp {
+			_ = ShowCommandHelp(cCtx, c.Name)
+		}
 		return cerr
 	}
 
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 6267ee8c6..051937e86 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -568,7 +568,7 @@ github.com/spf13/pflag
 github.com/stretchr/testify/assert
 github.com/stretchr/testify/require
 github.com/stretchr/testify/suite
-# github.com/urfave/cli/v2 v2.11.1
+# github.com/urfave/cli/v2 v2.11.2
 ## explicit; go 1.18
 github.com/urfave/cli/v2
 # github.com/vbatts/tar-split v0.11.2


Test patch:
diff --git a/internal/pkg/daemon/enricher/enricher_test.go b/internal/pkg/daemon/enricher/enricher_test.go
index e3ebeefd8..8d600ba71 100644
--- a/internal/pkg/daemon/enricher/enricher_test.go
+++ b/internal/pkg/daemon/enricher/enricher_test.go
@@ -323,7 +323,7 @@ func TestRun(t *testing.T) {
 		mock := &enricherfakes.FakeImpl{}
 		tc.prepare(mock, lineChan)
 
-		sut, ebuildErr := New(logr.Discard(), false, mock)
+		sut, ebuildErr := New(logr.Discard(), mock)
 		require.NoError(t, ebuildErr)
 
 		var err error
diff --git a/test/e2e_test.go b/test/e2e_test.go
index d1af87cd1..1b4f45662 100644
--- a/test/e2e_test.go
+++ b/test/e2e_test.go
@@ -39,12 +39,11 @@ const (
 	// NOTE(jaosorior): We should be able to decrease this once we
 	// migrate to a single daemonset-based implementation for the
 	// SELinux pieces.
-	defaultSelinuxOpTimeout       = "360s"
-	defaultLogEnricherOpTimeout   = defaultSelinuxOpTimeout
-	defaultBpfRecorderOpTimeout   = defaultSelinuxOpTimeout
-	defaultLabelPodDenialsTimeout = defaultSelinuxOpTimeout
-	defaultWaitTimeout            = "180s"
-	defaultWaitTime               = 15 * time.Second
+	defaultSelinuxOpTimeout     = "360s"
+	defaultLogEnricherOpTimeout = defaultSelinuxOpTimeout
+	defaultBpfRecorderOpTimeout = defaultSelinuxOpTimeout
+	defaultWaitTimeout          = "180s"
+	defaultWaitTime             = 15 * time.Second
 )
 
 // testCase define a type for a e2e test case.
@@ -101,10 +100,6 @@ func (e *e2e) TestSecurityProfilesOperator() {
 			"Log Enricher",
 			e.testCaseLogEnricher,
 		},
-		{
-			"SELinux: label problematic pod",
-			e.testCaseSelinuxLabelPodDenials,
-		},
 		{
 			"SELinux: base case (install policy, run pod and delete)",
 			e.testCaseSelinuxBaseUsage,
diff --git a/test/suite_test.go b/test/suite_test.go
index cd37a6869..b60364a7d 100644
--- a/test/suite_test.go
+++ b/test/suite_test.go
@@ -56,7 +56,6 @@ var (
 	envSeccompTestsEnabled          = os.Getenv("E2E_TEST_SECCOMP")
 	envProfileRecordingTestsEnabled = os.Getenv("E2E_TEST_PROFILE_RECORDING")
 	envBpfRecorderTestsEnabled      = os.Getenv("E2E_TEST_BPF_RECORDER")
-	envLabelPodDenialsEnabled       = os.Getenv("E2E_TEST_LABEL_POD_DENIALS")
 	envWebhookConfigTestsEnabled    = os.Getenv("E2E_TEST_WEBHOOK_CONFIG")
 	containerRuntime                = os.Getenv("CONTAINER_RUNTIME")
 	nodeRootfsPrefix                = os.Getenv("NODE_ROOTFS_PREFIX")
@@ -79,28 +78,27 @@ const (
 
 type e2e struct {
 	suite.Suite
-	containerRuntime       string
-	kubectlPath            string
-	testImage              string
-	selinuxdImage          string
-	pullPolicy             string
-	spodConfig             string
-	nodeRootfsPrefix       string
-	operatorManifest       string
-	selinuxEnabled         bool
-	logEnricherEnabled     bool
-	testSeccomp            bool
-	testProfileRecording   bool
-	labelPodDenialsEnabled bool
-	bpfRecorderEnabled     bool
-	skipNamespacedTests    bool
-	testWebhookConfig      bool
-	singleNodeEnvironment  bool
-	logger                 logr.Logger
-	execNode               func(node string, args ...string) string
-	waitForReadyPods       func()
-	deployCertManager      func()
-	setupRecordingSa       func(namespace string)
+	containerRuntime      string
+	kubectlPath           string
+	testImage             string
+	selinuxdImage         string
+	pullPolicy            string
+	spodConfig            string
+	nodeRootfsPrefix      string
+	operatorManifest      string
+	selinuxEnabled        bool
+	logEnricherEnabled    bool
+	testSeccomp           bool
+	testProfileRecording  bool
+	bpfRecorderEnabled    bool
+	skipNamespacedTests   bool
+	testWebhookConfig     bool
+	singleNodeEnvironment bool
+	logger                logr.Logger
+	execNode              func(node string, args ...string) string
+	waitForReadyPods      func()
+	deployCertManager     func()
+	setupRecordingSa      func(namespace string)
 }
 
 func defaultWaitForReadyPods(e *e2e) {
@@ -153,10 +151,6 @@ func TestSuite(t *testing.T) {
 	if err != nil {
 		bpfRecorderEnabled = false
 	}
-	labelPodDenialsEnabled, err := strconv.ParseBool(envLabelPodDenialsEnabled)
-	if err != nil {
-		labelPodDenialsEnabled = false
-	}
 
 	skipNamespacedTests, err := strconv.ParseBool(envSkipNamespacedTests)
 	if err != nil {
@@ -180,22 +174,21 @@ func TestSuite(t *testing.T) {
 		}
 		suite.Run(t, &kinde2e{
 			e2e{
-				logger:                 klogr.New(),
-				pullPolicy:             "Never",
-				testImage:              testImage,
-				spodConfig:             spodConfig,
-				containerRuntime:       containerRuntime,
-				nodeRootfsPrefix:       nodeRootfsPrefix,
-				selinuxEnabled:         selinuxEnabled,
-				logEnricherEnabled:     logEnricherEnabled,
-				testSeccomp:            testSeccomp,
-				testProfileRecording:   testProfileRecording,
-				selinuxdImage:          selinuxdImage,
-				bpfRecorderEnabled:     bpfRecorderEnabled,
-				labelPodDenialsEnabled: labelPodDenialsEnabled,
-				skipNamespacedTests:    skipNamespacedTests,
-				operatorManifest:       operatorManifest,
-				testWebhookConfig:      testWebhookConfig,
+				logger:               klogr.New(),
+				pullPolicy:           "Never",
+				testImage:            testImage,
+				spodConfig:           spodConfig,
+				containerRuntime:     containerRuntime,
+				nodeRootfsPrefix:     nodeRootfsPrefix,
+				selinuxEnabled:       selinuxEnabled,
+				logEnricherEnabled:   logEnricherEnabled,
+				testSeccomp:          testSeccomp,
+				testProfileRecording: testProfileRecording,
+				selinuxdImage:        selinuxdImage,
+				bpfRecorderEnabled:   bpfRecorderEnabled,
+				skipNamespacedTests:  skipNamespacedTests,
+				operatorManifest:     operatorManifest,
+				testWebhookConfig:    testWebhookConfig,
 			},
 			"", "",
 		})
@@ -213,21 +206,20 @@ func TestSuite(t *testing.T) {
 				logger: klogr.New(),
 				// Need to pull the image as it'll be uploaded to the cluster OCP
 				// image registry and not on the nodes.
-				pullPolicy:             "Always",
-				testImage:              testImage,
-				spodConfig:             spodConfig,
-				containerRuntime:       containerRuntime,
-				nodeRootfsPrefix:       nodeRootfsPrefix,
-				selinuxEnabled:         selinuxEnabled,
-				logEnricherEnabled:     logEnricherEnabled,
-				testSeccomp:            testSeccomp,
-				testProfileRecording:   testProfileRecording,
-				selinuxdImage:          selinuxdImage,
-				bpfRecorderEnabled:     bpfRecorderEnabled,
-				labelPodDenialsEnabled: labelPodDenialsEnabled,
-				skipNamespacedTests:    skipNamespacedTests,
-				operatorManifest:       operatorManifest,
-				testWebhookConfig:      testWebhookConfig,
+				pullPolicy:           "Always",
+				testImage:            testImage,
+				spodConfig:           spodConfig,
+				containerRuntime:     containerRuntime,
+				nodeRootfsPrefix:     nodeRootfsPrefix,
+				selinuxEnabled:       selinuxEnabled,
+				logEnricherEnabled:   logEnricherEnabled,
+				testSeccomp:          testSeccomp,
+				testProfileRecording: testProfileRecording,
+				selinuxdImage:        selinuxdImage,
+				bpfRecorderEnabled:   bpfRecorderEnabled,
+				skipNamespacedTests:  skipNamespacedTests,
+				operatorManifest:     operatorManifest,
+				testWebhookConfig:    testWebhookConfig,
 			},
 			skipBuildImages,
 			skipPushImages,
@@ -239,22 +231,21 @@ func TestSuite(t *testing.T) {
 		selinuxdImage = "quay.io/security-profiles-operator/selinuxd-fedora"
 		suite.Run(t, &vanilla{
 			e2e{
-				logger:                 klogr.New(),
-				pullPolicy:             "Never",
-				testImage:              testImage,
-				spodConfig:             spodConfig,
-				containerRuntime:       containerRuntime,
-				nodeRootfsPrefix:       nodeRootfsPrefix,
-				selinuxEnabled:         selinuxEnabled,
-				logEnricherEnabled:     logEnricherEnabled,
-				testSeccomp:            testSeccomp,
-				testProfileRecording:   testProfileRecording,
-				selinuxdImage:          selinuxdImage,
-				bpfRecorderEnabled:     bpfRecorderEnabled,
-				labelPodDenialsEnabled: labelPodDenialsEnabled,
-				skipNamespacedTests:    skipNamespacedTests,
-				operatorManifest:       operatorManifest,
-				testWebhookConfig:      testWebhookConfig,
+				logger:               klogr.New(),
+				pullPolicy:           "Never",
+				testImage:            testImage,
+				spodConfig:           spodConfig,
+				containerRuntime:     containerRuntime,
+				nodeRootfsPrefix:     nodeRootfsPrefix,
+				selinuxEnabled:       selinuxEnabled,
+				logEnricherEnabled:   logEnricherEnabled,
+				testSeccomp:          testSeccomp,
+				testProfileRecording: testProfileRecording,
+				selinuxdImage:        selinuxdImage,
+				bpfRecorderEnabled:   bpfRecorderEnabled,
+				skipNamespacedTests:  skipNamespacedTests,
+				operatorManifest:     operatorManifest,
+				testWebhookConfig:    testWebhookConfig,
 				// NOTE(jaosorior): Our current vanilla jobs are
 				// single-node only.
 				singleNodeEnvironment: true,
@@ -740,24 +731,6 @@ func (e *e2e) enableBpfRecorderInSpod() {
 	e.kubectlOperatorNS("rollout", "status", "ds", "spod", "--timeout", defaultBpfRecorderOpTimeout)
 }
 
-func (e *e2e) labelPodDenialsOnlyTestCase() {
-	if !e.labelPodDenialsEnabled {
-		e.T().Skip("Skipping label-denials-pod related test")
-	}
-
-	e.enableLabelingPodDenials()
-}
-
-func (e *e2e) enableLabelingPodDenials() {
-	e.logf("Enable labeling problematic pods in SPOD")
-	e.kubectlOperatorNS("patch", "spod", "spod", "-p", `{"spec":{"labelPodDenials": true}}`, "--type=merge")
-
-	time.Sleep(defaultWaitTime)
-	e.waitInOperatorNSFor("condition=ready", "spod", "spod")
-
-	e.kubectlOperatorNS("rollout", "status", "ds", "spod", "--timeout", defaultLabelPodDenialsTimeout)
-}
-
 func (e *e2e) deployRecordingSa(namespace string) {
 	saTemplate := `
     apiVersion: v1
diff --git a/test/tc_selinux_label_problematic_test.go b/test/tc_selinux_label_problematic_test.go
deleted file mode 100644
index 1bcdb4a10..000000000
--- a/test/tc_selinux_label_problematic_test.go
+++ /dev/null
@@ -1,93 +0,0 @@
-/*
-Copyright 2020 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package e2e_test
-
-import (
-	"fmt"
-	"regexp"
-	"time"
-
-	"sigs.k8s.io/security-profiles-operator/internal/pkg/util"
-)
-
-func (e *e2e) testCaseSelinuxLabelPodDenials([]string) {
-	e.selinuxOnlyTestCase()
-	e.logEnricherOnlyTestCase()
-	e.labelPodDenialsOnlyTestCase()
-
-	const podWithoutPolicy = `
-apiVersion: v1
-kind: Pod
-metadata:
-  name: el-no-policy
-spec:
-  initContainers:
-  - name: errorlogger
-    image: "registry.access.redhat.com/ubi8/ubi-minimal:latest"
-    command: ["/bin/bash"]
-    args: ["-c", "echo \"Time: $(date). Some error info.\" >> /var/log/test.log || /bin/true"]
-    volumeMounts:
-    - name: varlog
-      mountPath: /var/log
-  containers:
-  - name: pauser
-    image: "gcr.io/google_containers/pause:latest"
-  restartPolicy: Never
-  volumes:
-  - name: varlog
-    hostPath:
-      path: /var/log
-      type: Directory
-`
-	e.logf("sanity check: The 'errorlogger' workload should be blocked by SELinux")
-
-	e.logf("creating workload")
-	since := time.Now()
-	e.writeAndCreate(podWithoutPolicy, "pod-wo-policy.yml")
-
-	e.waitFor("condition=ready", "pod", "el-no-policy")
-
-	e.logf("the workload should have errored")
-	expectedLog := "/bin/bash: /var/log/test.log: Permission denied"
-	log := e.kubectl("logs", "el-no-policy", "-c", "errorlogger")
-	e.Equalf(expectedLog, log, "container should have returned a 'Permissions Denied' error")
-
-	e.logf("Should be marked as a problematic pod")
-
-	// wait for the enricher to mark the pod as problematic
-	e.waitForEnricherLogs(since, regexp.MustCompile(`(?m)"labeling problematic container".*podName"="el-no-policy"`))
-
-	// Naive check label is in the pod's metadata
-	podlabels := e.kubectl("get", "pods", "el-no-policy", "-o", "jsonpath={.metadata.labels}")
-	e.NotEmpty(podlabels, "pod should have labels")
-	e.Contains(podlabels, "spo.x-k8s.io/had-denials", "pod should be marked as problematic")
-
-	// Prove that filtering through label works. Retry several times to give more time for
-	// the label to actually arrive
-	if err := util.Retry(func() (err error) {
-		problematicPodList := e.kubectl("get", "pods", "-l", "spo.x-k8s.io/had-denials=",
-			"-o", "jsonpath={.items[*].metadata.name}")
-		if problematicPodList == "" {
-			return fmt.Errorf("no labeled pod yet")
-		}
-		return nil
-	}, func(err error) bool { return true }); err != nil {
-		e.Fail("problematic pod list should not be empty")
-	}
-
-	e.kubectl("delete", "pod", "el-no-policy")
-}