OCPBUGS-62730 - Fixed typos and truncated field values in JSON audit logs generated by the JSON enricher by BhargaviGudi · Pull Request #3071 · kubernetes-sigs/security-profiles-operator

BhargaviGudi · 2026-01-09T09:28:18Z

What type of PR is this?

/kind bug

What this PR does / why we need it:

This PR fixes typos and truncated field values in the JSON audit logs generated by the Security Profiles Operator's JSON enricher. The issue manifested as:

Misspelled keys: "namspace", "namepace", "amespace" instead of "namespace"
Truncated values: "ecurity-profiles-operator" instead of "security-profiles-operator"

Changes:

Extract podName, namespace, and containerName from ContainerInfo into local variables before assigning to the resource map
Create a local copy of nodeName before assigning to the node map

This ensures all JSON keys and values in audit logs are correctly spelled and complete.

Which issue(s) this PR fixes:

Fixes OCPBUGS-62730

Does this PR have test?

Tested manually to verify the values
test result:

export KUBECONFIG=/home/bgudi/work/src/github.com/openshift/kubeconfigFiles/370936/kubeconfig && NS="security-profiles-operator" && POD="my-pod"

# Run test commands
oc exec -n $NS $POD -- sh -c "id"
oc exec -n $NS $POD -- sh -c "cat /etc/os-release"
oc exec -n $NS $POD -- sh -c "ls -l /tmp"
oc exec -n $NS $POD -- sh -c "echo hello"
oc exec -n $NS $POD -- sh -c "hostname"

echo "Commands executed"
uid=0(root) gid=0(root) groups=0(root)
PRETTY_NAME="Debian GNU/Linux 10 (buster)"
NAME="Debian GNU/Linux"
VERSION_ID="10"
VERSION="10 (buster)"
VERSION_CODENAME=buster
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
total 0
hello
my-pod
Commands executed

$ oc rsh -n security-profiles-operator my-pod sh -c "id && hostname && pwd"
uid=0(root) gid=0(root) groups=0(root)
my-pod
/
$ oc rsh -n security-profiles-operator my-pod sh -c "whoami && date && uname -a"
root
Tue Mar 10 15:02:27 UTC 2026
Linux my-pod 5.14.0-570.96.1.el9_6.x86_64 #1 SMP PREEMPT_DYNAMIC Mon Mar 2 20:41:08 EST 2026 x86_64 GNU/Linux
$ oc debug node/bgudi-j9-85mrm-worker-b-mgdfh
Starting pod/bgudi-j9-85mrm-worker-b-mgdfh-debug-9wqth ...
To use host binaries, run `chroot /host`. Instead, if you need to access host namespaces, run `nsenter -a -t 1`.
Pod IP: 10.0.128.5
If you don't see a command prompt, try pressing enter.
sh-5.1# chroot /host
sh-5.1# cd /tmp/logs/
sh-5.1# ls -ltr
total 16
-rw-------. 1 root root 12384 Jan  9 09:10 audit1.log
sh-5.1# cd /tmp/logs/
sh-5.1# grep my-pod audit1.log 
{"auditID":"dcf1f056-20b5-436c-bea0-8b0dcc1ceeba","cmdLine":"nginx: worker process ","executable":"/usr/sbin/nginx","gid":0,"node":{"name":"bgudi-421-gbz8t-worker-c-sq569"},"pid":13839,"resource":{"container":"nginx","namespace":"security-profiles-operator","pod":"my-pod"},"syscalls":["getpid"],"timestamp":"2026-03-10T14:38:18.000Z","uid":0,"version":"spo/v1_alpha"}
{"auditID":"eafc2dba-fdd6-4061-a47d-9bfa6fc9a5a8","cmdLine":"","executable":"/usr/bin/crun","gid":0,"node":{"name":"bgudi-421-gbz8t-worker-c-sq569"},"pid":13813,"resource":{"container":"nginx","namespace":"security-profiles-operator","pod":"my-pod"},"syscalls":["execve","clone","getpid"],"timestamp":"2026-03-10T14:38:18.000Z","uid":0,"version":"spo/v1_alpha"}
{"auditID":"8e5abe10-94b0-4d8c-988e-949fc7bec62e","cmdLine":"env SPO_EXEC_REQUEST_UID=f0ee0b34-99ee-4303-9bb2-8628648e40eb sh -c id ","executable":"/usr/bin/crun","gid":0,"node":{"name":"bgudi-421-gbz8t-worker-c-sq569"},"pid":15980,"requestUID":"f0ee0b34-99ee-4303-9bb2-8628648e40eb","resource":{"container":"nginx","namespace":"security-profiles-operator","pod":"my-pod"},"syscalls":["clone","execve","getpid"],"timestamp":"2026-03-10T14:45:23.000Z","uid":0,"version":"spo/v1_alpha"}
{"auditID":"170fea62-6907-432b-baee-0ec80c9ceb30","cmdLine":"id ","executable":"/bin/dash","gid":0,"node":{"name":"bgudi-421-gbz8t-worker-c-sq569"},"pid":15981,"requestUID":"f0ee0b34-99ee-4303-9bb2-8628648e40eb","resource":{"container":"nginx","namespace":"security-profiles-operator","pod":"my-pod"},"syscalls":["execve"],"timestamp":"2026-03-10T14:45:23.000Z","uid":0,"version":"spo/v1_alpha"}
{"auditID":"bf87a8c2-256b-47a2-a7ac-9223f79ffd72","cmdLine":"env SPO_EXEC_REQUEST_UID=580bfd76-e3d3-434c-bea2-22002212a212 sh -c cat /etc/os-release ","executable":"/usr/bin/crun","gid":0,"node":{"name":"bgudi-421-gbz8t-worker-c-sq569"},"pid":15997,"requestUID":"580bfd76-e3d3-434c-bea2-22002212a212","resource":{"container":"nginx","namespace":"security-profiles-operator","pod":"my-pod"},"syscalls":["getpid","execve","clone"],"timestamp":"2026-03-10T14:45:28.000Z","uid":0,"version":"spo/v1_alpha"}
{"auditID":"c55ee8d5-9246-42cc-bbee-033e0dd53b32","cmdLine":"cat /etc/os-release ","executable":"/bin/dash","gid":0,"node":{"name":"bgudi-421-gbz8t-worker-c-sq569"},"pid":15998,"requestUID":"580bfd76-e3d3-434c-bea2-22002212a212","resource":{"container":"nginx","namespace":"security-profiles-operator","pod":"my-pod"},"syscalls":["execve"],"timestamp":"2026-03-10T14:45:28.000Z","uid":0,"version":"spo/v1_alpha"}
{"auditID":"1c338155-e939-41e2-a4ac-9ff00cf96114","cmdLine":"env SPO_EXEC_REQUEST_UID=866ee807-6843-44d3-b0bf-68efa0296aa7 sh -c ls -l /tmp ","executable":"/usr/bin/crun","gid":0,"node":{"name":"bgudi-421-gbz8t-worker-c-sq569"},"pid":16036,"requestUID":"866ee807-6843-44d3-b0bf-68efa0296aa7","resource":{"container":"nginx","namespace":"security-profiles-operator","pod":"my-pod"},"syscalls":["clone","getpid","execve"],"timestamp":"2026-03-10T14:45:33.000Z","uid":0,"version":"spo/v1_alpha"}
{"auditID":"310bd7f4-b20c-4bb0-ad90-8ccb2482989f","cmdLine":"ls -l /tmp ","executable":"/bin/dash","gid":0,"node":{"name":"bgudi-421-gbz8t-worker-c-sq569"},"pid":16037,"requestUID":"866ee807-6843-44d3-b0bf-68efa0296aa7","resource":{"container":"nginx","namespace":"security-profiles-operator","pod":"my-pod"},"syscalls":["execve"],"timestamp":"2026-03-10T14:45:33.000Z","uid":0,"version":"spo/v1_alpha"}
{"auditID":"cc5e8b03-45a7-434a-ad25-23d40ba42435","cmdLine":"env SPO_EXEC_REQUEST_UID=de193172-188c-4596-a2a0-b64f75a1b8e4 sh -c echo hello ","executable":"/usr/bin/crun","gid":0,"node":{"name":"bgudi-421-gbz8t-worker-c-sq569"},"pid":16054,"requestUID":"de193172-188c-4596-a2a0-b64f75a1b8e4","resource":{"container":"nginx","namespace":"security-profiles-operator","pod":"my-pod"},"syscalls":["execve","getpid"],"timestamp":"2026-03-10T14:45:38.000Z","uid":0,"version":"spo/v1_alpha"}
{"auditID":"8f6d2647-c645-46c8-8e68-71340865f0d5","cmdLine":"hostname ","executable":"/bin/dash","gid":0,"node":{"name":"bgudi-421-gbz8t-worker-c-sq569"},"pid":16086,"requestUID":"67fbde79-72ed-433f-af29-5e70aca699ae","resource":{"container":"nginx","namespace":"security-profiles-operator","pod":"my-pod"},"syscalls":["execve"],"timestamp":"2026-03-10T14:45:43.000Z","uid":0,"version":"spo/v1_alpha"}
{"auditID":"5bb77b98-62db-4fc7-8d6a-0e823eb129e9","cmdLine":"env SPO_EXEC_REQUEST_UID=67fbde79-72ed-433f-af29-5e70aca699ae sh -c hostname ","executable":"/usr/bin/crun","gid":0,"node":{"name":"bgudi-421-gbz8t-worker-c-sq569"},"pid":16085,"requestUID":"67fbde79-72ed-433f-af29-5e70aca699ae","resource":{"container":"nginx","namespace":"security-profiles-operator","pod":"my-pod"},"syscalls":["execve","getpid","clone"],"timestamp":"2026-03-10T14:45:43.000Z","uid":0,"version":"spo/v1_alpha"}
{"auditID":"01d38321-7418-4602-875c-1746d3280493","cmdLine":"id ","executable":"/bin/dash","gid":0,"node":{"name":"bgudi-421-gbz8t-worker-c-sq569"},"pid":21061,"requestUID":"bb9ed0f2-383f-49f8-8e3d-27afb62c8642","resource":{"container":"nginx","namespace":"security-profiles-operator","pod":"my-pod"},"syscalls":["execve"],"timestamp":"2026-03-10T15:02:14.000Z","uid":0,"version":"spo/v1_alpha"}
{"auditID":"f1f446ca-368c-4f89-9964-b04361121506","cmdLine":"hostname ","executable":"/bin/dash","gid":0,"node":{"name":"bgudi-421-gbz8t-worker-c-sq569"},"pid":21062,"requestUID":"bb9ed0f2-383f-49f8-8e3d-27afb62c8642","resource":{"container":"nginx","namespace":"security-profiles-operator","pod":"my-pod"},"syscalls":["execve"],"timestamp":"2026-03-10T15:02:14.000Z","uid":0,"version":"spo/v1_alpha"}
{"auditID":"ae322208-27f7-46f6-82da-561d23e38397","cmdLine":"env SPO_EXEC_REQUEST_UID=bb9ed0f2-383f-49f8-8e3d-27afb62c8642 sh -c id \u0026\u0026 hostname \u0026\u0026 pwd ","executable":"/usr/bin/crun","gid":0,"node":{"name":"bgudi-421-gbz8t-worker-c-sq569"},"pid":21060,"requestUID":"bb9ed0f2-383f-49f8-8e3d-27afb62c8642","resource":{"container":"nginx","namespace":"security-profiles-operator","pod":"my-pod"},"syscalls":["getpid","clone","execve"],"timestamp":"2026-03-10T15:02:14.000Z","uid":0,"version":"spo/v1_alpha"}
{"auditID":"71c8da94-3eb6-4375-baaa-0725a909bd8c","cmdLine":"date ","executable":"/bin/dash","gid":0,"node":{"name":"bgudi-421-gbz8t-worker-c-sq569"},"pid":21133,"requestUID":"7565f237-4c9c-4f1a-ac0f-107741f25658","resource":{"container":"nginx","namespace":"security-profiles-operator","pod":"my-pod"},"syscalls":["execve"],"timestamp":"2026-03-10T15:02:27.000Z","uid":0,"version":"spo/v1_alpha"}
{"auditID":"35caf221-ccb7-4d8f-8f18-21d21bedbae4","cmdLine":"env SPO_EXEC_REQUEST_UID=7565f237-4c9c-4f1a-ac0f-107741f25658 sh -c whoami \u0026\u0026 date \u0026\u0026 uname -a ","executable":"/usr/bin/crun","gid":0,"node":{"name":"bgudi-421-gbz8t-worker-c-sq569"},"pid":21131,"requestUID":"7565f237-4c9c-4f1a-ac0f-107741f25658","resource":{"container":"nginx","namespace":"security-profiles-operator","pod":"my-pod"},"syscalls":["getpid","clone","execve"],"timestamp":"2026-03-10T15:02:27.000Z","uid":0,"version":"spo/v1_alpha"}
{"auditID":"8a82fcac-7d8e-4688-a2c1-65dad315711a","cmdLine":"whoami ","executable":"/bin/dash","gid":0,"node":{"name":"bgudi-421-gbz8t-worker-c-sq569"},"pid":21132,"requestUID":"7565f237-4c9c-4f1a-ac0f-107741f25658","resource":{"container":"nginx","namespace":"security-profiles-operator","pod":"my-pod"},"syscalls":["execve"],"timestamp":"2026-03-10T15:02:27.000Z","uid":0,"version":"spo/v1_alpha"}
{"auditID":"c85b2c88-36b7-44af-af48-8c62f108865b","cmdLine":"uname -a ","executable":"/bin/dash","gid":0,"node":{"name":"bgudi-421-gbz8t-worker-c-sq569"},"pid":21134,"requestUID":"7565f237-4c9c-4f1a-ac0f-107741f25658","resource":{"container":"nginx","namespace":"security-profiles-operator","pod":"my-pod"},"syscalls":["execve"],"timestamp":"2026-03-10T15:02:27.000Z","uid":0,"version":"spo/v1_alpha"}

With this fix, all field names and values are now complete and correctly spelled.

Special notes for your reviewer:

The fix is minimal and surgical - by copying string values to local variables before map assignment, we prevent the memory corruption that was causing character truncation and field name typos. This is a critical fix for audit log reliability and automated log processing.

Does this PR introduce a user-facing change?

Fixed typos and truncated field values in JSON audit logs generated by the Security Profiles Operator's JSON enricher.

k8s-ci-robot · 2026-01-09T09:28:29Z

Hi @BhargaviGudi. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-ci-robot · 2026-01-09T09:28:34Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: BhargaviGudi
Once this PR has been reviewed and has the lgtm label, please assign ccojocar for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

codecov-commenter · 2026-01-09T09:34:58Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 24.26%. Comparing base (11d77f4) to head (43a5e54).
⚠️ Report is 1085 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #3071       +/-   ##
===========================================
- Coverage   45.50%   24.26%   -21.24%     
===========================================
  Files          79      125       +46     
  Lines        7782    17776     +9994     
===========================================
+ Hits         3541     4313      +772     
- Misses       4099    13176     +9077     
- Partials      142      287      +145

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

saschagrunert · 2026-01-12T12:19:21Z

/ok-to-test

BhargaviGudi · 2026-01-29T10:10:39Z

@ngopalak-redhat Could you please help me review the PR? Thanks

BhargaviGudi · 2026-02-06T09:45:52Z

/retitle OCPBUGS-62730: Fixed typos and truncated field values in JSON audit logs generated by the JSON enricher

k8s-ci-robot · 2026-02-06T09:46:01Z

@BhargaviGudi: Re-titling can only be requested by trusted users, like repository collaborators.

Details

In response to this:

/retitle OCPBUGS-62730: Fixed typos and truncated field values in JSON audit logs generated by the JSON enricher

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

resolved format issue Updated proper synchronization for the LogBucket Resolved go-lint issues revert nodeNameCopy := nodeName

BhargaviGudi · 2026-03-10T15:15:51Z

/verified

BhargaviGudi · 2026-03-30T06:24:34Z

/payload-job periodic-ci-openshift-openshift-tests-private-release-4.22-amd64-nightly-baremetalds-ipi-ovn-lvms-f14-security-profiles

k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jan 9, 2026

k8s-ci-robot requested review from Vincent056 and ngopalak-redhat January 9, 2026 09:28

k8s-ci-robot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Jan 9, 2026

BhargaviGudi force-pushed the OCPBUGS-62730-fix branch from 81e7e67 to 224b145 Compare January 9, 2026 09:57

ngopalak-redhat requested changes Jan 9, 2026

View reviewed changes

Comment thread internal/pkg/daemon/enricher/jsonenricher.go

k8s-ci-robot assigned ngopalak-redhat Jan 9, 2026

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jan 12, 2026

BhargaviGudi force-pushed the OCPBUGS-62730-fix branch 2 times, most recently from 006a556 to 9d57d22 Compare January 21, 2026 13:33

ngopalak-redhat requested changes Feb 17, 2026

View reviewed changes

Comment thread internal/pkg/daemon/enricher/jsonenricher.go Outdated

OCPBUGS-62730 - update jsonenricher.go

43a5e54

resolved format issue Updated proper synchronization for the LogBucket Resolved go-lint issues revert nodeNameCopy := nodeName

BhargaviGudi force-pushed the OCPBUGS-62730-fix branch from 9d57d22 to 43a5e54 Compare March 10, 2026 15:00

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OCPBUGS-62730 - Fixed typos and truncated field values in JSON audit logs generated by the JSON enricher#3071

OCPBUGS-62730 - Fixed typos and truncated field values in JSON audit logs generated by the JSON enricher#3071
BhargaviGudi wants to merge 1 commit intokubernetes-sigs:mainfrom
BhargaviGudi:OCPBUGS-62730-fix

BhargaviGudi commented Jan 9, 2026 •

edited

Loading

Uh oh!

k8s-ci-robot commented Jan 9, 2026

Uh oh!

k8s-ci-robot commented Jan 9, 2026

Uh oh!

codecov-commenter commented Jan 9, 2026 •

edited

Loading

Uh oh!

Uh oh!

saschagrunert commented Jan 12, 2026

Uh oh!

BhargaviGudi commented Jan 29, 2026

Uh oh!

BhargaviGudi commented Feb 6, 2026

Uh oh!

k8s-ci-robot commented Feb 6, 2026

Uh oh!

Uh oh!

BhargaviGudi commented Mar 10, 2026

Uh oh!

BhargaviGudi commented Mar 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

BhargaviGudi commented Jan 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Does this PR have test?

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Uh oh!

k8s-ci-robot commented Jan 9, 2026

Uh oh!

k8s-ci-robot commented Jan 9, 2026

Uh oh!

codecov-commenter commented Jan 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

saschagrunert commented Jan 12, 2026

Uh oh!

BhargaviGudi commented Jan 29, 2026

Uh oh!

BhargaviGudi commented Feb 6, 2026

Uh oh!

k8s-ci-robot commented Feb 6, 2026

Uh oh!

Uh oh!

BhargaviGudi commented Mar 10, 2026

Uh oh!

BhargaviGudi commented Mar 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

BhargaviGudi commented Jan 9, 2026 •

edited

Loading

codecov-commenter commented Jan 9, 2026 •

edited

Loading