Repository: kubernetes-sigs/security-profiles-operator
Pull request #1291 (2022-11-10 15:53:37)

Configurable the daemon resource requirements
<!--  Thanks for sending a pull request!  Here are some tips for you:

- If this is your first time, please read our contributor guidelines: https://git.k8s.io/community/contributors/guide#your-first-contribution and developer guide https://git.k8s.io/community/contributors/devel/development.md#development-guide
- Please label this pull request according to what type of issue you are addressing, especially if this is a release targeted pull request. For reference on required PR/issue labels, read here:
https://git.k8s.io/community/contributors/devel/sig-release/release.md#issuepr-kind-label
- If you want *faster* PR reviews, read how: https://git.k8s.io/community/contributors/guide/pull-requests.md#best-practices-for-faster-reviews
- If the PR is unfinished, see how to mark it: https://git.k8s.io/community/contributors/guide/pull-requests.md#marking-unfinished-pull-requests
-->

#### What type of PR is this?

<!--
Add one of the following kinds:
/kind bug
/kind cleanup
/kind documentation
/kind feature
/kind design

Optionally add one or more of the following kinds if applicable:
/kind api-change
/kind deprecation
/kind failing-test
/kind flake
/kind regression
-->

/kind feature

#### What this PR does / why we need it:

It makes configurable the daemon resource requirements. This is useful when the daemon requires different resource requirements due to the cluster size (e.g. number of pods is watching for).

#### Which issue(s) this PR fixes:

<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.

Fixes #

or

None
-->

#### Does this PR have test?

<!--
If tests aren't applicable just write N/A.
-->

#### Special notes for your reviewer:

#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
Make the daemon resource requirements configurable.

```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1291#" title="Author self-approved">ccojocar</a>*
**Once this PR has been reviewed and has the lgtm label**, please assign jhrozek for approval by writing `/assign @jhrozek` in a comment. For more information see [the Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["jhrozek"]} -->
k8s-ci-robot: @ccojocar: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-e2e | e6799be8fbc54759fa85d19e935a7f363ae4b120 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1291/pull-security-profiles-operator-test-e2e/1590734439862767616) | true | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1291). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Accojocar). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @ccojocar: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-e2e | e6799be8fbc54759fa85d19e935a7f363ae4b120 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1291/pull-security-profiles-operator-test-e2e/1590734439862767616) | true | `/test pull-security-profiles-operator-test-e2e`
pull-security-profiles-operator-build | e6799be8fbc54759fa85d19e935a7f363ae4b120 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1291/pull-security-profiles-operator-build/1590734439669829632) | true | `/test pull-security-profiles-operator-build`
pull-security-profiles-operator-test-unit | e6799be8fbc54759fa85d19e935a7f363ae4b120 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1291/pull-security-profiles-operator-test-unit/1590734439753715712) | true | `/test pull-security-profiles-operator-test-unit`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1291). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Accojocar). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @ccojocar: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-e2e | e6799be8fbc54759fa85d19e935a7f363ae4b120 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1291/pull-security-profiles-operator-test-e2e/1590734439862767616) | true | `/test pull-security-profiles-operator-test-e2e`
pull-security-profiles-operator-build | e6799be8fbc54759fa85d19e935a7f363ae4b120 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1291/pull-security-profiles-operator-build/1590734439669829632) | true | `/test pull-security-profiles-operator-build`
pull-security-profiles-operator-test-unit | e6799be8fbc54759fa85d19e935a7f363ae4b120 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1291/pull-security-profiles-operator-test-unit/1590734439753715712) | true | `/test pull-security-profiles-operator-test-unit`
pull-security-profiles-operator-build-image | e6799be8fbc54759fa85d19e935a7f363ae4b120 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1291/pull-security-profiles-operator-build-image/1590734439816630272) | true | `/test pull-security-profiles-operator-build-image`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1291). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Accojocar). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @ccojocar: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-e2e | e6799be8fbc54759fa85d19e935a7f363ae4b120 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1291/pull-security-profiles-operator-test-e2e/1590734439862767616) | true | `/test pull-security-profiles-operator-test-e2e`
pull-security-profiles-operator-build | e6799be8fbc54759fa85d19e935a7f363ae4b120 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1291/pull-security-profiles-operator-build/1590734439669829632) | true | `/test pull-security-profiles-operator-build`
pull-security-profiles-operator-test-unit | e6799be8fbc54759fa85d19e935a7f363ae4b120 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1291/pull-security-profiles-operator-test-unit/1590734439753715712) | true | `/test pull-security-profiles-operator-test-unit`
pull-security-profiles-operator-build-image | e6799be8fbc54759fa85d19e935a7f363ae4b120 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1291/pull-security-profiles-operator-build-image/1590734439816630272) | true | `/test pull-security-profiles-operator-build-image`
pull-security-profiles-operator-verify | e6799be8fbc54759fa85d19e935a7f363ae4b120 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1291/pull-security-profiles-operator-verify/1590734439715966976) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1291). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Accojocar). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
ccojocar: /assign @saschagrunert 
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1291#" title="Author self-approved">ccojocar</a>*
**Once this PR has been reviewed and has the lgtm label**, please ask for approval from saschagrunert by writing `/assign @saschagrunert` in a comment. For more information see [the Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["saschagrunert"]} -->
codecov-commenter: # [Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/1291?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) Report
> Merging [#1291](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/1291?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) (c58de75) into [main](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/commit/e87e953f8631436301bd2606f26efe304e0f5c3e?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) (e87e953) will **decrease** coverage by `0.02%`.
> The diff coverage is `0.00%`.

<details><summary>Additional details and impacted files</summary>


```diff
@@            Coverage Diff             @@
##             main    #1291      +/-   ##
==========================================
- Coverage   44.80%   44.77%   -0.03%     
==========================================
  Files          48       48              
  Lines        5406     5409       +3     
==========================================
  Hits         2422     2422              
- Misses       2864     2867       +3     
  Partials      120      120              
```

</details>
jhrozek: It would be nice to document the new options. I'm on the fence about a test, ideally we should have everything tested (and e.g. we do have tests for webhook label changes), but the patch "just" adds a public kube type, so..*shrug*.

By the way, thanks a lot for doing this performance and scalability work!
k8s-ci-robot: @ccojocar: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | f8d0dc05fe81aef50b0b263466876ddf28d07f9d | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1291/pull-security-profiles-operator-verify/1590985673169440768) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1291). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Accojocar). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
ccojocar: > It would be nice to document the new options. I'm on the fence about a test, ideally we should have everything tested (and e.g. we do have tests for webhook label changes), but the patch "just" adds a public kube type, so..shrug.


I'll add some docs and tests.
k8s-ci-robot: @ccojocar: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | ba1638e954ec2fa4500672922c1667d5994475be | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1291/pull-security-profiles-operator-verify/1590992257522077696) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1291). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Accojocar). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @ccojocar: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | 5d58adeab9e4fb4df44a8e629f3b64297ebe67ad | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1291/pull-security-profiles-operator-verify/1591002002198892544) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1291). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Accojocar). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
ccojocar: @jhrozek @pjbgf I think that I addressed all your remarks. I added some documentation and an e2e test.
k8s-ci-robot: @ccojocar: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | 0bb83983f76f6dd0d374be864ef59ab3da2e2f14 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1291/pull-security-profiles-operator-verify/1591024104268369920) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1291). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Accojocar). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
ccojocar:  /test all

Patch:
diff --git a/.golangci.yml b/.golangci.yml
index a5daca68c..5f1b80885 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -12,6 +12,9 @@ issues:
     - linters:
         - goerr113
       text: do not define dynamic errors, use wrapped static errors instead
+    - linters:
+        - lll
+      source: "^//go:generate " # exclude lll issues for long lines with go:generate
 linters:
   disable-all: true
   enable:
diff --git a/Makefile b/Makefile
index a9eef43a5..5c1273832 100644
--- a/Makefile
+++ b/Makefile
@@ -77,6 +77,7 @@ ifeq ($(BPF_ENABLED), 1)
 CGO_LDFLAGS := $(CGO_LDFLAGS) -lelf -lz -lbpf
 else
 BUILDTAGS := $(BUILDTAGS) no_bpf
+LINT_BUILDTAGS := $(LINT_BUILDTAGS),no_bpf
 endif
 
 export CGO_LDFLAGS
@@ -200,15 +201,6 @@ update-go-mod: ## Cleanup, vendor and verify go modules
 .PHONY: update-mocks
 update-mocks: ## Update all generated mocks
 	$(GO) generate ./...
-	for f in $(shell find . -path ./vendor -prune -false -o -name fake_*.go); do \
-		cp hack/boilerplate/boilerplate.generatego.txt tmp ;\
-		cat $$f >> tmp ;\
-		mv tmp $$f ;\
-	done
-	export BPF_IMPL=internal/pkg/daemon/bpfrecorder/bpfrecorderfakes/fake_impl.go && \
-	printf "//go:build linux && !no_bpf\n// +build linux,!no_bpf\n\n" | \
-		cat - $$BPF_IMPL | \
-		tee $$BPF_IMPL >/dev/null
 
 define go-build
 	CGO_LDFLAGS= $(GO) build -o $(BUILD_DIR)/$(shell basename $(1)) $(1)
diff --git a/README.md b/README.md
index 8d63864d6..1bdc3a42e 100644
--- a/README.md
+++ b/README.md
@@ -52,8 +52,8 @@ Here's the feature parity status across them:
 |----------------------------------|---------|---------|----------|
 |                      Profile CRD |   Yes   |   Yes   |    Yes   |
 |                   ProfileBinding |   Yes   |   No    |    No    |
-|       Deploy profiles into nodes |   Yes   |   Yes   |    WIP   |
-| Remove profiles no longer in use |   Yes   |   Yes   |    WIP   |
+|       Deploy profiles into nodes |   Yes   |   Yes   |    Yes   |
+| Remove profiles no longer in use |   Yes   |   Yes   |    Yes   |
 |   Profile Auto-generation (logs) |   Yes   |   WIP   |    No    |
 |   Profile Auto-generation (ebpf) |   Yes   |   No    |    No    |
 |             Audit log enrichment |   Yes   |   WIP   |    Yes   |
diff --git a/api/spod/v1alpha1/spod_types.go b/api/spod/v1alpha1/spod_types.go
index 9fdc5c40b..f2209e6ff 100644
--- a/api/spod/v1alpha1/spod_types.go
+++ b/api/spod/v1alpha1/spod_types.go
@@ -308,6 +308,11 @@ type SPODSpec struct {
 	// namespace to use for pulling the images from SPOD pod from a private registry.
 	// +optional
 	ImagePullSecrets []corev1.LocalObjectReference `json:"imagePullSecrets,omitempty"`
+
+	// DaemonResourceRequirements if defined, overwrites the default resource requirements
+	// of SPOD daemon.
+	// +optional
+	DaemonResourceRequirements *corev1.ResourceRequirements `json:"daemonResourceRequirements,omitempty"`
 }
 
 // SPODState defines the state that the spod is in.
diff --git a/api/spod/v1alpha1/zz_generated.deepcopy.go b/api/spod/v1alpha1/zz_generated.deepcopy.go
index d3a3f94fc..b78c00c42 100644
--- a/api/spod/v1alpha1/zz_generated.deepcopy.go
+++ b/api/spod/v1alpha1/zz_generated.deepcopy.go
@@ -110,6 +110,11 @@ func (in *SPODSpec) DeepCopyInto(out *SPODSpec) {
 		*out = make([]corev1.LocalObjectReference, len(*in))
 		copy(*out, *in)
 	}
+	if in.DaemonResourceRequirements != nil {
+		in, out := &in.DaemonResourceRequirements, &out.DaemonResourceRequirements
+		*out = new(corev1.ResourceRequirements)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SPODSpec.
diff --git a/bundle/manifests/security-profiles-operator.clusterserviceversion.yaml b/bundle/manifests/security-profiles-operator.clusterserviceversion.yaml
index cdb820e90..cbb3e74cf 100644
--- a/bundle/manifests/security-profiles-operator.clusterserviceversion.yaml
+++ b/bundle/manifests/security-profiles-operator.clusterserviceversion.yaml
@@ -427,7 +427,7 @@ spec:
                 - manager
                 env:
                 - name: RELATED_IMAGE_RBAC_PROXY
-                  value: quay.io/brancz/kube-rbac-proxy:v0.11.0
+                  value: quay.io/brancz/kube-rbac-proxy:v0.13.1
                 - name: RELATED_IMAGE_SELINUXD
                   value: quay.io/security-profiles-operator/selinuxd
                 - name: OPERATOR_NAMESPACE
@@ -504,7 +504,7 @@ spec:
     name: Kubernetes SIGs
     url: https://github.com/kubernetes-sigs
   relatedImages:
-  - image: quay.io/brancz/kube-rbac-proxy:v0.11.0
+  - image: quay.io/brancz/kube-rbac-proxy:v0.13.1
     name: rbac-proxy
   - image: quay.io/security-profiles-operator/selinuxd
     name: selinuxd
diff --git a/bundle/manifests/security-profiles-operator.x-k8s.io_securityprofilesoperatordaemons.yaml b/bundle/manifests/security-profiles-operator.x-k8s.io_securityprofilesoperatordaemons.yaml
index c7c718af4..1d5147430 100644
--- a/bundle/manifests/security-profiles-operator.x-k8s.io_securityprofilesoperatordaemons.yaml
+++ b/bundle/manifests/security-profiles-operator.x-k8s.io_securityprofilesoperatordaemons.yaml
@@ -884,6 +884,33 @@ spec:
                 items:
                   type: string
                 type: array
+              daemonResourceRequirements:
+                description: DaemonResourceRequirements if defined, overwrites the
+                  default resource requirements of SPOD daemon.
+                properties:
+                  limits:
+                    additionalProperties:
+                      anyOf:
+                      - type: integer
+                      - type: string
+                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                      x-kubernetes-int-or-string: true
+                    description: 'Limits describes the maximum amount of compute resources
+                      allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
+                    type: object
+                  requests:
+                    additionalProperties:
+                      anyOf:
+                      - type: integer
+                      - type: string
+                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                      x-kubernetes-int-or-string: true
+                    description: 'Requests describes the minimum amount of compute
+                      resources required. If Requests is omitted for a container,
+                      it defaults to Limits if that is explicitly specified, otherwise
+                      to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
+                    type: object
+                type: object
               enableAppArmor:
                 description: tells the operator whether or not to enable AppArmor
                   support for this SPOD instance.
diff --git a/dependencies.yaml b/dependencies.yaml
index 5163738ae..c71d292e9 100644
--- a/dependencies.yaml
+++ b/dependencies.yaml
@@ -110,7 +110,7 @@ dependencies:
       match: NIX_VERSION
 
   - name: kube-rbac-proxy
-    version: 0.13.0
+    version: 0.13.1
     refPaths:
     - path: internal/pkg/manager/spod/bindata/spod.go
       match: quay.io/brancz/kube-rbac-proxy
diff --git a/deploy/base-crds/crds/securityprofilesoperatordaemon.yaml b/deploy/base-crds/crds/securityprofilesoperatordaemon.yaml
index a43564f50..b6bdd4761 100644
--- a/deploy/base-crds/crds/securityprofilesoperatordaemon.yaml
+++ b/deploy/base-crds/crds/securityprofilesoperatordaemon.yaml
@@ -882,6 +882,33 @@ spec:
                 items:
                   type: string
                 type: array
+              daemonResourceRequirements:
+                description: DaemonResourceRequirements if defined, overwrites the
+                  default resource requirements of SPOD daemon.
+                properties:
+                  limits:
+                    additionalProperties:
+                      anyOf:
+                      - type: integer
+                      - type: string
+                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                      x-kubernetes-int-or-string: true
+                    description: 'Limits describes the maximum amount of compute resources
+                      allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
+                    type: object
+                  requests:
+                    additionalProperties:
+                      anyOf:
+                      - type: integer
+                      - type: string
+                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                      x-kubernetes-int-or-string: true
+                    description: 'Requests describes the minimum amount of compute
+                      resources required. If Requests is omitted for a container,
+                      it defaults to Limits if that is explicitly specified, otherwise
+                      to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
+                    type: object
+                type: object
               enableAppArmor:
                 description: tells the operator whether or not to enable AppArmor
                   support for this SPOD instance.
diff --git a/deploy/helm/crds/crds.yaml b/deploy/helm/crds/crds.yaml
index b1a7fd0ea..95ddd2616 100644
--- a/deploy/helm/crds/crds.yaml
+++ b/deploy/helm/crds/crds.yaml
@@ -1409,6 +1409,33 @@ spec:
                 items:
                   type: string
                 type: array
+              daemonResourceRequirements:
+                description: DaemonResourceRequirements if defined, overwrites the
+                  default resource requirements of SPOD daemon.
+                properties:
+                  limits:
+                    additionalProperties:
+                      anyOf:
+                      - type: integer
+                      - type: string
+                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                      x-kubernetes-int-or-string: true
+                    description: 'Limits describes the maximum amount of compute resources
+                      allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
+                    type: object
+                  requests:
+                    additionalProperties:
+                      anyOf:
+                      - type: integer
+                      - type: string
+                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                      x-kubernetes-int-or-string: true
+                    description: 'Requests describes the minimum amount of compute
+                      resources required. If Requests is omitted for a container,
+                      it defaults to Limits if that is explicitly specified, otherwise
+                      to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
+                    type: object
+                type: object
               enableAppArmor:
                 description: tells the operator whether or not to enable AppArmor
                   support for this SPOD instance.
diff --git a/deploy/helm/templates/deployment.yaml b/deploy/helm/templates/deployment.yaml
index 2d093f124..2a9b7fb37 100644
--- a/deploy/helm/templates/deployment.yaml
+++ b/deploy/helm/templates/deployment.yaml
@@ -27,7 +27,7 @@ spec:
         - manager
         env:
         - name: RELATED_IMAGE_RBAC_PROXY
-          value: quay.io/brancz/kube-rbac-proxy:v0.11.0
+          value: quay.io/brancz/kube-rbac-proxy:v0.13.1
         - name: RELATED_IMAGE_SELINUXD
           value: quay.io/security-profiles-operator/selinuxd
         - name: OPERATOR_NAMESPACE
diff --git a/deploy/kustomize-deployment/manager_deployment.yaml b/deploy/kustomize-deployment/manager_deployment.yaml
index b573d596b..140d3e3c2 100644
--- a/deploy/kustomize-deployment/manager_deployment.yaml
+++ b/deploy/kustomize-deployment/manager_deployment.yaml
@@ -35,7 +35,7 @@ spec:
               memory: 128Mi
           env:
             - name: RELATED_IMAGE_RBAC_PROXY
-              value: quay.io/brancz/kube-rbac-proxy:v0.11.0
+              value: quay.io/brancz/kube-rbac-proxy:v0.13.1
             - name: RELATED_IMAGE_SELINUXD
               value: quay.io/security-profiles-operator/selinuxd
             - name: OPERATOR_NAMESPACE
diff --git a/deploy/namespace-operator.yaml b/deploy/namespace-operator.yaml
index 74e5589d3..c2da4f612 100644
--- a/deploy/namespace-operator.yaml
+++ b/deploy/namespace-operator.yaml
@@ -1409,6 +1409,33 @@ spec:
                 items:
                   type: string
                 type: array
+              daemonResourceRequirements:
+                description: DaemonResourceRequirements if defined, overwrites the
+                  default resource requirements of SPOD daemon.
+                properties:
+                  limits:
+                    additionalProperties:
+                      anyOf:
+                      - type: integer
+                      - type: string
+                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                      x-kubernetes-int-or-string: true
+                    description: 'Limits describes the maximum amount of compute resources
+                      allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
+                    type: object
+                  requests:
+                    additionalProperties:
+                      anyOf:
+                      - type: integer
+                      - type: string
+                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                      x-kubernetes-int-or-string: true
+                    description: 'Requests describes the minimum amount of compute
+                      resources required. If Requests is omitted for a container,
+                      it defaults to Limits if that is explicitly specified, otherwise
+                      to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
+                    type: object
+                type: object
               enableAppArmor:
                 description: tells the operator whether or not to enable AppArmor
                   support for this SPOD instance.
@@ -2929,7 +2956,7 @@ spec:
         - name: RESTRICT_TO_NAMESPACE
           value: NS_REPLACE
         - name: RELATED_IMAGE_RBAC_PROXY
-          value: quay.io/brancz/kube-rbac-proxy:v0.11.0
+          value: quay.io/brancz/kube-rbac-proxy:v0.13.1
         - name: RELATED_IMAGE_SELINUXD
           value: quay.io/security-profiles-operator/selinuxd
         - name: OPERATOR_NAMESPACE
diff --git a/deploy/openshift-dev.yaml b/deploy/openshift-dev.yaml
index a686ff515..5653a3522 100644
--- a/deploy/openshift-dev.yaml
+++ b/deploy/openshift-dev.yaml
@@ -1409,6 +1409,33 @@ spec:
                 items:
                   type: string
                 type: array
+              daemonResourceRequirements:
+                description: DaemonResourceRequirements if defined, overwrites the
+                  default resource requirements of SPOD daemon.
+                properties:
+                  limits:
+                    additionalProperties:
+                      anyOf:
+                      - type: integer
+                      - type: string
+                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                      x-kubernetes-int-or-string: true
+                    description: 'Limits describes the maximum amount of compute resources
+                      allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
+                    type: object
+                  requests:
+                    additionalProperties:
+                      anyOf:
+                      - type: integer
+                      - type: string
+                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                      x-kubernetes-int-or-string: true
+                    description: 'Requests describes the minimum amount of compute
+                      resources required. If Requests is omitted for a container,
+                      it defaults to Limits if that is explicitly specified, otherwise
+                      to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
+                    type: object
+                type: object
               enableAppArmor:
                 description: tells the operator whether or not to enable AppArmor
                   support for this SPOD instance.
@@ -2927,7 +2954,7 @@ spec:
         - manager
         env:
         - name: RELATED_IMAGE_RBAC_PROXY
-          value: quay.io/brancz/kube-rbac-proxy:v0.11.0
+          value: quay.io/brancz/kube-rbac-proxy:v0.13.1
         - name: RELATED_IMAGE_SELINUXD
           value: quay.io/security-profiles-operator/selinuxd
         - name: OPERATOR_NAMESPACE
diff --git a/deploy/operator.yaml b/deploy/operator.yaml
index 2759b30fc..cf8ecbe4d 100644
--- a/deploy/operator.yaml
+++ b/deploy/operator.yaml
@@ -1409,6 +1409,33 @@ spec:
                 items:
                   type: string
                 type: array
+              daemonResourceRequirements:
+                description: DaemonResourceRequirements if defined, overwrites the
+                  default resource requirements of SPOD daemon.
+                properties:
+                  limits:
+                    additionalProperties:
+                      anyOf:
+                      - type: integer
+                      - type: string
+                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                      x-kubernetes-int-or-string: true
+                    description: 'Limits describes the maximum amount of compute resources
+                      allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
+                    type: object
+                  requests:
+                    additionalProperties:
+                      anyOf:
+                      - type: integer
+                      - type: string
+                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                      x-kubernetes-int-or-string: true
+                    description: 'Requests describes the minimum amount of compute
+                      resources required. If Requests is omitted for a container,
+                      it defaults to Limits if that is explicitly specified, otherwise
+                      to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
+                    type: object
+                type: object
               enableAppArmor:
                 description: tells the operator whether or not to enable AppArmor
                   support for this SPOD instance.
@@ -2927,7 +2954,7 @@ spec:
         - manager
         env:
         - name: RELATED_IMAGE_RBAC_PROXY
-          value: quay.io/brancz/kube-rbac-proxy:v0.11.0
+          value: quay.io/brancz/kube-rbac-proxy:v0.13.1
         - name: RELATED_IMAGE_SELINUXD
           value: quay.io/security-profiles-operator/selinuxd
         - name: OPERATOR_NAMESPACE
diff --git a/deploy/webhook-operator.yaml b/deploy/webhook-operator.yaml
index 8d8904f3b..d1cbe85b6 100644
--- a/deploy/webhook-operator.yaml
+++ b/deploy/webhook-operator.yaml
@@ -1585,6 +1585,33 @@ spec:
                 items:
                   type: string
                 type: array
+              daemonResourceRequirements:
+                description: DaemonResourceRequirements if defined, overwrites the
+                  default resource requirements of SPOD daemon.
+                properties:
+                  limits:
+                    additionalProperties:
+                      anyOf:
+                      - type: integer
+                      - type: string
+                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                      x-kubernetes-int-or-string: true
+                    description: 'Limits describes the maximum amount of compute resources
+                      allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
+                    type: object
+                  requests:
+                    additionalProperties:
+                      anyOf:
+                      - type: integer
+                      - type: string
+                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                      x-kubernetes-int-or-string: true
+                    description: 'Requests describes the minimum amount of compute
+                      resources required. If Requests is omitted for a container,
+                      it defaults to Limits if that is explicitly specified, otherwise
+                      to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
+                    type: object
+                type: object
               enableAppArmor:
                 description: tells the operator whether or not to enable AppArmor
                   support for this SPOD instance.
@@ -2927,7 +2954,7 @@ spec:
         - --webhook=false
         env:
         - name: RELATED_IMAGE_RBAC_PROXY
-          value: quay.io/brancz/kube-rbac-proxy:v0.11.0
+          value: quay.io/brancz/kube-rbac-proxy:v0.13.1
         - name: RELATED_IMAGE_SELINUXD
           value: quay.io/security-profiles-operator/selinuxd
         - name: OPERATOR_NAMESPACE
diff --git a/go.mod b/go.mod
index 9a3fc4a22..092d9a7c7 100644
--- a/go.mod
+++ b/go.mod
@@ -26,11 +26,11 @@ require (
 	google.golang.org/grpc v1.50.1
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.2.0
 	google.golang.org/protobuf v1.28.1
-	k8s.io/api v0.25.3
+	k8s.io/api v0.25.4
 	k8s.io/apimachinery v0.25.4
-	k8s.io/client-go v0.25.3
+	k8s.io/client-go v0.25.4
 	k8s.io/klog/v2 v2.80.1
-	sigs.k8s.io/controller-runtime v0.13.0
+	sigs.k8s.io/controller-runtime v0.13.1
 	sigs.k8s.io/controller-tools v0.10.0
 	sigs.k8s.io/mdtoc v1.1.0
 	sigs.k8s.io/release-utils v0.7.3
diff --git a/go.sum b/go.sum
index 936b53708..94a70d093 100644
--- a/go.sum
+++ b/go.sum
@@ -2134,8 +2134,8 @@ k8s.io/api v0.20.4/go.mod h1:++lNL1AJMkDymriNniQsWRkMDzRaX2Y/POTUi8yvqYQ=
 k8s.io/api v0.20.6/go.mod h1:X9e8Qag6JV/bL5G6bU8sdVRltWKmdHsFUGS3eVndqE8=
 k8s.io/api v0.22.5/go.mod h1:mEhXyLaSD1qTOf40rRiKXkc+2iCem09rWLlFwhCEiAs=
 k8s.io/api v0.23.0/go.mod h1:8wmDdLBHBNxtOIytwLstXt5E9PddnZb0GaMcqsvDBpg=
-k8s.io/api v0.25.3 h1:Q1v5UFfYe87vi5H7NU0p4RXC26PPMT8KOpr1TLQbCMQ=
-k8s.io/api v0.25.3/go.mod h1:o42gKscFrEVjHdQnyRenACrMtbuJsVdP+WVjqejfzmI=
+k8s.io/api v0.25.4 h1:3YO8J4RtmG7elEgaWMb4HgmpS2CfY1QlaOz9nwB+ZSs=
+k8s.io/api v0.25.4/go.mod h1:IG2+RzyPQLllQxnhzD8KQNEu4c4YvyDTpSMztf4A0OQ=
 k8s.io/apiextensions-apiserver v0.25.2 h1:8uOQX17RE7XL02ngtnh3TgifY7EhekpK+/piwzQNnBo=
 k8s.io/apiextensions-apiserver v0.25.2/go.mod h1:iRwwRDlWPfaHhuBfQ0WMa5skdQfrE18QXJaJvIDLvE8=
 k8s.io/apimachinery v0.20.1/go.mod h1:WlLqWAHZGg07AeltaI0MV5uk1Omp8xaN0JGLY6gkRpU=
@@ -2156,8 +2156,8 @@ k8s.io/client-go v0.20.1/go.mod h1:/zcHdt1TeWSd5HoUe6elJmHSQ6uLLgp4bIJHVEuy+/Y=
 k8s.io/client-go v0.20.4/go.mod h1:LiMv25ND1gLUdBeYxBIwKpkSC5IsozMMmOOeSJboP+k=
 k8s.io/client-go v0.20.6/go.mod h1:nNQMnOvEUEsOzRRFIIkdmYOjAZrC8bgq0ExboWSU1I0=
 k8s.io/client-go v0.22.5/go.mod h1:cs6yf/61q2T1SdQL5Rdcjg9J1ElXSwbjSrW2vFImM4Y=
-k8s.io/client-go v0.25.3 h1:oB4Dyl8d6UbfDHD8Bv8evKylzs3BXzzufLiO27xuPs0=
-k8s.io/client-go v0.25.3/go.mod h1:t39LPczAIMwycjcXkVc+CB+PZV69jQuNx4um5ORDjQA=
+k8s.io/client-go v0.25.4 h1:3RNRDffAkNU56M/a7gUfXaEzdhZlYhoW8dgViGy5fn8=
+k8s.io/client-go v0.25.4/go.mod h1:8trHCAC83XKY0wsBIpbirZU4NTUpbuhc2JnI7OruGZw=
 k8s.io/code-generator v0.19.7/go.mod h1:lwEq3YnLYb/7uVXLorOJfxg+cUu2oihFhHZ0n9NIla0=
 k8s.io/code-generator v0.23.0/go.mod h1:vQvOhDXhuzqiVfM/YHp+dmg10WDZCchJVObc9MvowsE=
 k8s.io/component-base v0.20.1/go.mod h1:guxkoJnNoh8LNrbtiQOlyp2Y2XFCZQmrcg2n/DeYNLk=
@@ -2208,8 +2208,8 @@ rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.14/go.mod h1:LEScyzhFmoF5pso/YSeBstl57mOzx9xlU9n85RGrDQg=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.15/go.mod h1:LEScyzhFmoF5pso/YSeBstl57mOzx9xlU9n85RGrDQg=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.22/go.mod h1:LEScyzhFmoF5pso/YSeBstl57mOzx9xlU9n85RGrDQg=
-sigs.k8s.io/controller-runtime v0.13.0 h1:iqa5RNciy7ADWnIc8QxCbOX5FEKVR3uxVxKHRMc2WIQ=
-sigs.k8s.io/controller-runtime v0.13.0/go.mod h1:Zbz+el8Yg31jubvAEyglRZGdLAjplZl+PgtYNI6WNTI=
+sigs.k8s.io/controller-runtime v0.13.1 h1:tUsRCSJVM1QQOOeViGeX3GMT3dQF1eePPw6sEE3xSlg=
+sigs.k8s.io/controller-runtime v0.13.1/go.mod h1:Zbz+el8Yg31jubvAEyglRZGdLAjplZl+PgtYNI6WNTI=
 sigs.k8s.io/controller-tools v0.10.0 h1:0L5DTDTFB67jm9DkfrONgTGmfc/zYow0ZaHyppizU2U=
 sigs.k8s.io/controller-tools v0.10.0/go.mod h1:uvr0EW6IsprfB0jpQq6evtKy+hHyHCXNfdWI5ONPx94=
 sigs.k8s.io/gateway-api v0.5.0 h1:ze+k9fJqvmL8s1t3e4q1ST8RnN+f09dEv+gfacahlAE=
diff --git a/hack/boilerplate/boilerplate.generatego.bpf.txt b/hack/boilerplate/boilerplate.generatego.bpf.txt
new file mode 100644
index 000000000..543ac96de
--- /dev/null
+++ b/hack/boilerplate/boilerplate.generatego.bpf.txt
@@ -0,0 +1,19 @@
+//go:build linux && !no_bpf
+// +build linux,!no_bpf
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
diff --git a/installation-usage.md b/installation-usage.md
index 767667302..776f79ac7 100644
--- a/installation-usage.md
+++ b/installation-usage.md
@@ -13,6 +13,7 @@
 - [Set logging verbosity](#set-logging-verbosity)
 - [Pull images from private registry](#pull-images-from-private-registry)
 - [Configure the SELinux type](#configure-the-selinux-type)
+- [Customise the daemon resource requirements](#customise-the-daemon-resource-requirements)
 - [Restrict the allowed syscalls in seccomp profiles](#restrict-the-allowed-syscalls-in-seccomp-profiles)
 - [Constrain spod scheduling](#constrain-spod-scheduling)
 - [Create a seccomp profile](#create-a-seccomp-profile)
@@ -231,6 +232,16 @@ The `ds/spod` should now be updated by the manager with the new SELinux type, an
             type: unconfined_t
 ```
 
+## Customise the daemon resource requirements
+
+The default resource requirements of the daemon container can be adjusted by using the field `daemonResourceRequirements`
+from the SPOD configuration as follows:
+
+```
+kubectl -n security-profiles-operator patch spod spod --type merge -p
+'{"spec":{"daemonResourceRequirements": {"requests": {"memory": "256Mi", "cpu": "250m"}, "limits": {"memory": "512Mi", "cpu": "500m"}}}}'
+```
+
 ## Restrict the allowed syscalls in seccomp profiles
 
 The operator doesn't restrict by default the allowed syscalls in the seccomp profiles. This means that any
@@ -1505,6 +1516,16 @@ defined within `spec.policy`. Otherwise the reconciler will fail as it
 won't be able to confirm the policy was correctly loaded.
 - The reconciler will simply load the profiles across the cluster. If an
 existing profile with the same name exists, it will be replaced.
+- The SPO does not validate the profile contents. Invalid profiles
+will error when loading into the kernel. The error can be found on the spod
+pod and the message will roughly look like:
+```
+E1112 08:35:24.072544    8668 controller.go:326]  "msg"="Reconciler error" "error"="cannot load profile into node: running action: exit status 1" "appArmorProfile"={"name":"<NAME_OF_PROFILE>","namespace":"security-profiles-operator"} "controller"="apparmorprofile" "controllerGroup"="security-profiles-operator.x-k8s.io" "controllerKind"="AppArmorProfile" "name"="<NAME_OF_PROFILE>" "namespace"="security-profiles-operator" "reconcileID"="035a4edd-cdd9-4c35-a1be-924939538ce4"
+```.
+- Restrictive profiles may block sub processes to be created, or a container from
+successfully loading. In such cases, the denied rules may not show up in the
+log-enricher logs, as SPO may fail to find the running process to correlate to the
+pod information. To work around the issue, set the AppArmor profile to complain mode.
 
 ## Uninstalling
 
diff --git a/internal/pkg/daemon/bpfrecorder/impl.go b/internal/pkg/daemon/bpfrecorder/impl.go
index 7fd3dbb08..dc0ed5bd4 100644
--- a/internal/pkg/daemon/bpfrecorder/impl.go
+++ b/internal/pkg/daemon/bpfrecorder/impl.go
@@ -47,7 +47,7 @@ import (
 
 type defaultImpl struct{}
 
-//go:generate go run github.com/maxbrunsfeld/counterfeiter/v6 -generate
+//go:generate go run github.com/maxbrunsfeld/counterfeiter/v6 -generate -header ../../../../hack/boilerplate/boilerplate.generatego.bpf.txt
 //counterfeiter:generate . impl
 type impl interface {
 	Getenv(string) string
diff --git a/internal/pkg/daemon/enricher/audit.go b/internal/pkg/daemon/enricher/audit.go
index 34febf3b1..28adc0ca0 100644
--- a/internal/pkg/daemon/enricher/audit.go
+++ b/internal/pkg/daemon/enricher/audit.go
@@ -20,6 +20,7 @@ import (
 	"fmt"
 	"regexp"
 	"strconv"
+	"strings"
 
 	"sigs.k8s.io/security-profiles-operator/internal/pkg/daemon/enricher/types"
 )
@@ -32,11 +33,16 @@ var (
 	selinuxLineRegex = regexp.MustCompile(
 		`type=AVC.+audit\((.+)\).+{ (.+) }.+pid=(\b\d+\b).*scontext=(.+) tcontext=(.+) tclass=(\b\w+\b).*`,
 	)
+	apparmorLineRegex = regexp.MustCompile(
+		//nolint:lll // no need to wrap regex
+		`(type=APPARMOR|audit:.+type=1400).+audit\((.+)\).+apparmor="(.+)".+operation="([a-zA-Z0-9\/\-\_]+)"\s(?:info.+)?profile="(.+)".+name="(.+)".+pid=(\b\d+\b).+comm="([a-zA-Z0-9\/\-\_]+)"\s?(.*)?`,
+	)
 )
 
 var (
-	minSeccompCapturesExpected = 5
-	minSelinuxCapturesExpected = 7
+	minSeccompCapturesExpected  = 5
+	minSelinuxCapturesExpected  = 7
+	minAppArmorCapturesExpected = 9
 )
 
 // isAuditLine checks whether logLine is a supported audit line.
@@ -47,7 +53,12 @@ func isAuditLine(logLine string) bool {
 	}
 
 	captures = selinuxLineRegex.FindStringSubmatch(logLine)
-	return len(captures) >= minSelinuxCapturesExpected
+	if len(captures) >= minSelinuxCapturesExpected {
+		return true
+	}
+
+	captures = apparmorLineRegex.FindStringSubmatch(logLine)
+	return len(captures) >= minAppArmorCapturesExpected
 }
 
 // extractAuditLine extracts an auditline from logLine.
@@ -60,6 +71,10 @@ func extractAuditLine(logLine string) (*types.AuditLine, error) {
 		return selinux, nil
 	}
 
+	if apparmor := extractApparmorLine(logLine); apparmor != nil {
+		return apparmor, nil
+	}
+
 	return nil, fmt.Errorf("unsupported log line: %s", logLine)
 }
 
@@ -107,3 +122,27 @@ func extractSelinuxLine(logLine string) *types.AuditLine {
 
 	return &line
 }
+
+func extractApparmorLine(logLine string) *types.AuditLine {
+	captures := apparmorLineRegex.FindStringSubmatch(logLine)
+	if len(captures) < minAppArmorCapturesExpected {
+		return nil
+	}
+
+	line := types.AuditLine{}
+	line.AuditType = types.AuditTypeApparmor
+	line.TimestampID = captures[2]
+	line.Apparmor = captures[3]
+	line.Operation = captures[4]
+	line.Profile = captures[5]
+	line.Name = captures[6]
+	line.Executable = captures[8]
+	if v, err := strconv.Atoi(captures[7]); err == nil {
+		line.ProcessID = v
+	}
+
+	if len(captures) > minAppArmorCapturesExpected {
+		line.ExtraInfo = strings.ReplaceAll(captures[9], "\"", "'")
+	}
+	return &line
+}
diff --git a/internal/pkg/daemon/enricher/enricher.go b/internal/pkg/daemon/enricher/enricher.go
index 85ac3bc99..b9283b41a 100644
--- a/internal/pkg/daemon/enricher/enricher.go
+++ b/internal/pkg/daemon/enricher/enricher.go
@@ -364,6 +364,8 @@ func (e *Enricher) dispatchAuditLine(
 		e.dispatchSelinuxLine(metricsClient, nodeName, auditLine, info)
 	case types.AuditTypeSeccomp:
 		e.dispatchSeccompLine(metricsClient, nodeName, auditLine, info)
+	case types.AuditTypeApparmor:
+		e.dispatchApparmorLine(nodeName, auditLine, info)
 	default:
 		return fmt.Errorf("unknown audit line type %s", auditLine.AuditType)
 	}
@@ -484,6 +486,33 @@ func (e *Enricher) dispatchSeccompLine(
 	}
 }
 
+func (e *Enricher) dispatchApparmorLine(
+	nodeName string,
+	auditLine *types.AuditLine,
+	info *types.ContainerInfo,
+) {
+	values := []interface{}{
+		"timestamp", auditLine.TimestampID,
+		"type", auditLine.AuditType,
+		"node", nodeName,
+		"namespace", info.Namespace,
+		"pod", info.PodName,
+		"container", info.ContainerName,
+		"executable", auditLine.Executable,
+		"pid", auditLine.ProcessID,
+		"apparmor", auditLine.Apparmor,
+		"operation", auditLine.Operation,
+		"profile", auditLine.Profile,
+		"name", auditLine.Name,
+	}
+
+	if auditLine.ExtraInfo != "" {
+		values = append(values, "extra", auditLine.ExtraInfo)
+	}
+
+	e.logger.Info("audit", values...)
+}
+
 // logFilePath returns either the path to the audit logs or falls back to
 // syslog if the audit log path does not exist.
 func logFilePath() string {
diff --git a/internal/pkg/daemon/enricher/impl.go b/internal/pkg/daemon/enricher/impl.go
index eab44448e..58e7468be 100644
--- a/internal/pkg/daemon/enricher/impl.go
+++ b/internal/pkg/daemon/enricher/impl.go
@@ -37,7 +37,7 @@ import (
 
 type defaultImpl struct{}
 
-//go:generate go run github.com/maxbrunsfeld/counterfeiter/v6 -generate
+//go:generate go run github.com/maxbrunsfeld/counterfeiter/v6 -generate -header ../../../../hack/boilerplate/boilerplate.generatego.txt
 //counterfeiter:generate . impl
 type impl interface {
 	Getenv(key string) string
diff --git a/internal/pkg/daemon/enricher/types/types.go b/internal/pkg/daemon/enricher/types/types.go
index 949b9793b..ec7e4ef88 100644
--- a/internal/pkg/daemon/enricher/types/types.go
+++ b/internal/pkg/daemon/enricher/types/types.go
@@ -17,8 +17,9 @@ limitations under the License.
 package types
 
 const (
-	AuditTypeSeccomp = "seccomp"
-	AuditTypeSelinux = "selinux"
+	AuditTypeSeccomp  = "seccomp"
+	AuditTypeSelinux  = "selinux"
+	AuditTypeApparmor = "apparmor"
 )
 
 type AuditLine struct {
@@ -37,6 +38,17 @@ type AuditLine struct {
 	Tcontext string
 	Tclass   string
 	Perm     string
+
+	// apparmor
+	Apparmor  string
+	Operation string
+	// Profile is the name of the AppArmor profile under which the operation took place.
+	Profile string
+	// Name is what the operation wanted to access.
+	Name string
+	// ExtraInfo may contain addition information such as:
+	// requested_mask, denied_mask, fsuid=65534, ouid and target.
+	ExtraInfo string
 }
 
 type ContainerInfo struct {
diff --git a/internal/pkg/daemon/metrics/impl.go b/internal/pkg/daemon/metrics/impl.go
index 0e6c91a5a..d8348b2ae 100644
--- a/internal/pkg/daemon/metrics/impl.go
+++ b/internal/pkg/daemon/metrics/impl.go
@@ -26,7 +26,7 @@ import (
 
 type defaultImpl struct{}
 
-//go:generate go run github.com/maxbrunsfeld/counterfeiter/v6 -generate
+//go:generate go run github.com/maxbrunsfeld/counterfeiter/v6 -generate -header ../../../../hack/boilerplate/boilerplate.generatego.txt
 //counterfeiter:generate . impl
 type impl interface {
 	Register(c prometheus.Collector) error
diff --git a/internal/pkg/daemon/profilerecorder/impl.go b/internal/pkg/daemon/profilerecorder/impl.go
index b3a1ac929..6afce7e51 100644
--- a/internal/pkg/daemon/profilerecorder/impl.go
+++ b/internal/pkg/daemon/profilerecorder/impl.go
@@ -42,7 +42,7 @@ import (
 
 type defaultImpl struct{}
 
-//go:generate go run github.com/maxbrunsfeld/counterfeiter/v6 -generate
+//go:generate go run github.com/maxbrunsfeld/counterfeiter/v6 -generate -header ../../../../hack/boilerplate/boilerplate.generatego.txt
 //counterfeiter:generate . impl
 type impl interface {
 	NewClient(ctrl.Manager) (client.Client, error)
diff --git a/internal/pkg/manager/spod/bindata/spod.go b/internal/pkg/manager/spod/bindata/spod.go
index 49b876665..d5b4fdd73 100644
--- a/internal/pkg/manager/spod/bindata/spod.go
+++ b/internal/pkg/manager/spod/bindata/spod.go
@@ -53,7 +53,7 @@ const (
 	SelinuxdPrivateDir                         = "/var/run/selinuxd"
 	SelinuxdSocketPath                         = SelinuxdPrivateDir + "/selinuxd.sock"
 	SelinuxdDBPath                             = SelinuxdPrivateDir + "/selinuxd.db"
-	MetricsImage                               = "quay.io/brancz/kube-rbac-proxy:v0.13.0"
+	MetricsImage                               = "quay.io/brancz/kube-rbac-proxy:v0.13.1"
 	sysKernelDebugPath                         = "/sys/kernel/debug"
 	InitContainerIDNonRootenabler              = 0
 	InitContainerIDSelinuxSharedPoliciesCopier = 1
diff --git a/internal/pkg/manager/spod/spod_controller.go b/internal/pkg/manager/spod/spod_controller.go
index e06e42eb1..b459f954a 100644
--- a/internal/pkg/manager/spod/spod_controller.go
+++ b/internal/pkg/manager/spod/spod_controller.go
@@ -472,6 +472,11 @@ func (r *ReconcileSPOd) getConfiguredSPOd(
 		}
 	}
 
+	// Overwrite the SPOD's default resource requirements
+	if cfg.Spec.DaemonResourceRequirements != nil {
+		templateSpec.Containers[bindata.ContainerIDDaemon].Resources = *cfg.Spec.DaemonResourceRequirements
+	}
+
 	// SELinux parameters
 	enableSelinux := (cfg.Spec.EnableSelinux != nil && *cfg.Spec.EnableSelinux) ||
 		// enable SELinux support per default in OpenShift
diff --git a/internal/pkg/nonrootenabler/nonrootenabler.go b/internal/pkg/nonrootenabler/nonrootenabler.go
index 088562f43..7084f9b2f 100644
--- a/internal/pkg/nonrootenabler/nonrootenabler.go
+++ b/internal/pkg/nonrootenabler/nonrootenabler.go
@@ -98,7 +98,7 @@ func (n *NonRootEnabler) Run(logger logr.Logger) error {
 	return nil
 }
 
-//go:generate go run github.com/maxbrunsfeld/counterfeiter/v6 -generate
+//go:generate go run github.com/maxbrunsfeld/counterfeiter/v6 -generate -header ../../../hack/boilerplate/boilerplate.generatego.txt
 //counterfeiter:generate . impl
 type impl interface {
 	MkdirAll(path string, perm os.FileMode) error
diff --git a/internal/pkg/webhooks/binding/impl.go b/internal/pkg/webhooks/binding/impl.go
index dcb52bbcf..ad75cfe6a 100644
--- a/internal/pkg/webhooks/binding/impl.go
+++ b/internal/pkg/webhooks/binding/impl.go
@@ -37,7 +37,7 @@ type defaultImpl struct {
 	decoder *admission.Decoder
 }
 
-//go:generate go run github.com/maxbrunsfeld/counterfeiter/v6 -generate
+//go:generate go run github.com/maxbrunsfeld/counterfeiter/v6 -generate -header ../../../../hack/boilerplate/boilerplate.generatego.txt
 //counterfeiter:generate . impl
 type impl interface {
 	ListProfileBindings(context.Context, ...client.ListOption) (*v1alpha1.ProfileBindingList, error)
diff --git a/internal/pkg/webhooks/recording/impl.go b/internal/pkg/webhooks/recording/impl.go
index 99744d85e..bd1b79101 100644
--- a/internal/pkg/webhooks/recording/impl.go
+++ b/internal/pkg/webhooks/recording/impl.go
@@ -38,7 +38,7 @@ type defaultImpl struct {
 	decoder *admission.Decoder
 }
 
-//go:generate go run github.com/maxbrunsfeld/counterfeiter/v6 -generate
+//go:generate go run github.com/maxbrunsfeld/counterfeiter/v6 -generate -header ../../../../hack/boilerplate/boilerplate.generatego.txt
 //counterfeiter:generate . impl
 type impl interface {
 	GetProfileRecording(ctx context.Context, name, namespace string) (*v1alpha1.ProfileRecording, error)
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 0b18e6e91..f97a430c8 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -816,7 +816,7 @@ helm.sh/helm/v3/pkg/plugin
 helm.sh/helm/v3/pkg/provenance
 helm.sh/helm/v3/pkg/registry
 helm.sh/helm/v3/pkg/repo
-# k8s.io/api v0.25.3
+# k8s.io/api v0.25.4
 ## explicit; go 1.19
 k8s.io/api/admission/v1
 k8s.io/api/admission/v1beta1
@@ -926,7 +926,7 @@ k8s.io/apimachinery/third_party/forked/golang/reflect
 k8s.io/cli-runtime/pkg/genericclioptions
 k8s.io/cli-runtime/pkg/printers
 k8s.io/cli-runtime/pkg/resource
-# k8s.io/client-go v0.25.3
+# k8s.io/client-go v0.25.4
 ## explicit; go 1.19
 k8s.io/client-go/applyconfigurations/admissionregistration/v1
 k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1
@@ -1108,7 +1108,7 @@ oras.land/oras-go/pkg/registry/remote/auth
 oras.land/oras-go/pkg/registry/remote/internal/errutil
 oras.land/oras-go/pkg/registry/remote/internal/syncutil
 oras.land/oras-go/pkg/target
-# sigs.k8s.io/controller-runtime v0.13.0
+# sigs.k8s.io/controller-runtime v0.13.1
 ## explicit; go 1.17
 sigs.k8s.io/controller-runtime
 sigs.k8s.io/controller-runtime/pkg/builder
diff --git a/vendor/sigs.k8s.io/controller-runtime/pkg/manager/internal.go b/vendor/sigs.k8s.io/controller-runtime/pkg/manager/internal.go
index 5b22c628f..fb79c5544 100644
--- a/vendor/sigs.k8s.io/controller-runtime/pkg/manager/internal.go
+++ b/vendor/sigs.k8s.io/controller-runtime/pkg/manager/internal.go
@@ -18,6 +18,7 @@ package manager
 
 import (
 	"context"
+	"crypto/tls"
 	"errors"
 	"fmt"
 	"net"
@@ -135,6 +136,8 @@ type controllerManager struct {
 	// if not set, webhook server would look up the server key and certificate in
 	// {TempDir}/k8s-webhook-server/serving-certs
 	certDir string
+	// tlsOpts is used to allow configuring the TLS config used for the webhook server.
+	tlsOpts []func(*tls.Config)
 
 	webhookServer *webhook.Server
 	// webhookServerOnce will be called in GetWebhookServer() to optionally initialize
@@ -305,6 +308,7 @@ func (cm *controllerManager) GetWebhookServer() *webhook.Server {
 				Port:    cm.port,
 				Host:    cm.host,
 				CertDir: cm.certDir,
+				TLSOpts: cm.tlsOpts,
 			}
 		}
 		if err := cm.Add(cm.webhookServer); err != nil {
diff --git a/vendor/sigs.k8s.io/controller-runtime/pkg/manager/manager.go b/vendor/sigs.k8s.io/controller-runtime/pkg/manager/manager.go
index 53716aa9f..2b28fa4b5 100644
--- a/vendor/sigs.k8s.io/controller-runtime/pkg/manager/manager.go
+++ b/vendor/sigs.k8s.io/controller-runtime/pkg/manager/manager.go
@@ -18,6 +18,7 @@ package manager
 
 import (
 	"context"
+	"crypto/tls"
 	"fmt"
 	"net"
 	"net/http"
@@ -241,6 +242,9 @@ type Options struct {
 	// It is used to set webhook.Server.CertDir if WebhookServer is not set.
 	CertDir string
 
+	// TLSOpts is used to allow configuring the TLS config used for the webhook server.
+	TLSOpts []func(*tls.Config)
+
 	// WebhookServer is an externally configured webhook.Server. By default,
 	// a Manager will create a default server using Port, Host, and CertDir;
 	// if this is set, the Manager will use this server instead.
@@ -421,6 +425,7 @@ func New(config *rest.Config, options Options) (Manager, error) {
 		port:                          options.Port,
 		host:                          options.Host,
 		certDir:                       options.CertDir,
+		tlsOpts:                       options.TLSOpts,
 		webhookServer:                 options.WebhookServer,
 		leaseDuration:                 *options.LeaseDuration,
 		renewDeadline:                 *options.RenewDeadline,


Test patch:
diff --git a/internal/pkg/daemon/enricher/audit_test.go b/internal/pkg/daemon/enricher/audit_test.go
index 02562831a..f4d700eae 100644
--- a/internal/pkg/daemon/enricher/audit_test.go
+++ b/internal/pkg/daemon/enricher/audit_test.go
@@ -17,6 +17,7 @@ limitations under the License.
 package enricher
 
 import (
+	"fmt"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -72,6 +73,18 @@ func Test_isAuditLine(t *testing.T) {
 			`type=AVC msg=audit(1666691794.882:1434): avc:  denied  { read write open } for  pid=94509 comm="aide" path="/hostroot/etc/kubernetes/aide.log.new" dev="nvme0n1p4" ino=167774224 scontext=system_u:system_r:selinuxrecording.process:s0:c218,c875 tcontext=system_u:object_r:kubernetes_file_t:s0 tclass=file permissive=1`,
 			true,
 		},
+		{
+			"Should identify AppArmor log lines",
+			//nolint:lll // no need to wrap
+			`audit: type=1400 audit(1668191154.949:64): apparmor="DENIED" operation="exec" profile="profile-name" name="/usr/local/bin/sample-app" pid=4166 comm="tini"`,
+			true,
+		},
+		{
+			"Should identify AppArmor long log lines",
+			//nolint:lll // no need to wrap
+			`audit: type=1400 audit(1668191154.949:64): apparmor="DENIED" operation="exec" profile="profile-name" name="/usr/local/bin/sample-app" pid=4166 comm="tini" requested_mask="x" denied_mask="x" fsuid=65534 ouid=0`,
+			true,
+		},
 	}
 	for _, tt := range tests {
 		tt := tt
@@ -151,6 +164,45 @@ func Test_extractAuditLine(t *testing.T) {
 			},
 			nil,
 		},
+		{
+			"Should extract apparmor log lines",
+			//nolint:lll // no need to wrap
+			`audit: type=1400 audit(1668191154.949:64): apparmor="DENIED" operation="exec" profile="profile-name" name="/usr/local/bin/sample-app" pid=4166 comm="tini"`,
+			&types.AuditLine{
+				AuditType:   "apparmor",
+				TimestampID: "1668191154.949:64",
+				ProcessID:   4166,
+				Apparmor:    "DENIED",
+				Operation:   "exec",
+				Profile:     "profile-name",
+				Name:        "/usr/local/bin/sample-app",
+				Executable:  "tini",
+			},
+			nil,
+		},
+		{
+			"Should extract apparmor long log lines",
+			//nolint:lll // no need to wrap
+			`audit: type=1400 audit(1668191154.949:64): apparmor="DENIED" operation="exec" profile="profile-name" name="/usr/local/bin/sample-app" pid=4166 comm="tini" requested_mask="x" denied_mask="x" fsuid=65534 ouid=0`,
+			&types.AuditLine{
+				AuditType:   "apparmor",
+				TimestampID: "1668191154.949:64",
+				ProcessID:   4166,
+				Apparmor:    "DENIED",
+				Operation:   "exec",
+				Profile:     "profile-name",
+				Name:        "/usr/local/bin/sample-app",
+				Executable:  "tini",
+				ExtraInfo:   "requested_mask='x' denied_mask='x' fsuid=65534 ouid=0",
+			},
+			nil,
+		},
+		{
+			"Should not extract suppressed lines",
+			`[ 3683.829070] kauditd_printk_skb: 1 callbacks suppressed`,
+			nil,
+			fmt.Errorf("unsupported log line: %s", `[ 3683.829070] kauditd_printk_skb: 1 callbacks suppressed`),
+		},
 	}
 	for _, tt := range tests {
 		tt := tt
diff --git a/test/e2e_test.go b/test/e2e_test.go
index e26e28df8..36ef01da0 100644
--- a/test/e2e_test.go
+++ b/test/e2e_test.go
@@ -112,6 +112,10 @@ func (e *e2e) TestSecurityProfilesOperator() {
 			"SPOD: Change verbosity",
 			e.testCaseVerbosityChange,
 		},
+		{
+			"SPOD: Change resource requirements",
+			e.testCaseResourceRequirementsChange,
+		},
 		{
 			"Seccomp: make sure statuses for profiles with long names can be listed",
 			e.testCaseLongSeccompProfileName,
diff --git a/test/tc_daemon_resource_requirements_test.go b/test/tc_daemon_resource_requirements_test.go
new file mode 100644
index 000000000..df6aaa795
--- /dev/null
+++ b/test/tc_daemon_resource_requirements_test.go
@@ -0,0 +1,45 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e_test
+
+import (
+	"time"
+)
+
+func (e *e2e) testCaseResourceRequirementsChange([]string) {
+	e.logf("Change resource requirements in spod")
+	e.kubectlOperatorNS(
+		"patch",
+		"spod",
+		"spod",
+		"-p",
+		`{"spec":{"daemonResourceRequirements": 
+		{"requests": {"memory": "256Mi", "cpu": "250m"}, 
+		"limits": {"memory": "512Mi", "cpu": "500m"}}}}`,
+		"--type=merge")
+	time.Sleep(defaultWaitTime)
+
+	e.waitInOperatorNSFor("condition=ready", "spod", "spod")
+	e.kubectlOperatorNS("rollout", "status", "ds", "spod", "--timeout", defaultBpfRecorderOpTimeout)
+
+	updatedResourcesInSPODDS := e.kubectlOperatorNS("get", "ds", "spod", "-o", "yaml")
+
+	e.Contains(updatedResourcesInSPODDS, "256Mi")
+	e.Contains(updatedResourcesInSPODDS, "250m")
+	e.Contains(updatedResourcesInSPODDS, "512Mi")
+	e.Contains(updatedResourcesInSPODDS, "500m")
+}