---
title: Enabling the Security Profiles Operator
---

# Enabling the Security Profiles Operator {#spo-enabling}

Before you can use the Security Profiles Operator, you must ensure the Operator is deployed in the cluster.

> [!IMPORTANT]
> All cluster nodes must have the same release version in order for this Operator to function properly. As an example, for nodes running RHCOS, all nodes must have the same RHCOS version.

> [!IMPORTANT]
> The Security Profiles Operator supports only Red Hat Enterprise Linux CoreOS (RHCOS) worker nodes. Red Hat Enterprise Linux (RHEL) nodes are not supported.

> [!IMPORTANT]
> The Security Profiles Operator supports `x86_64` and `ppc64le` architecture.

## Installing the Security Profiles Operator {#spo-installing_spo-enabling}

You can use the OpenShift Container Platform web console to install the Security Profiles Operator. This installs the Security Profiles Operator into the `openshift-security-profiles` namespace by default. You can also verify correct installation by using the OpenShift Container Platform web console.

**Prerequisites**

- You must have access to the web console as a user with `cluster-admin` privileges.

**Procedure**

1. In the OpenShift Container Platform web console, navigate to **Ecosystem** → **Software Catalog**.
2. Search for the Security Profiles Operator, then click **Install**.
3. Keep the default selection of **Installation mode** and **namespace** to ensure that the Operator will be installed to the `openshift-security-profiles` namespace.
4. Click **Install**.

**Verification**

To confirm that the installation is successful:

1. Navigate to the **Ecosystem** → **Installed Operators** page.
2. Check that the Security Profiles Operator is installed in the `openshift-security-profiles` namespace and its status is `Succeeded`.

If the Operator is not installed successfully:

1. Navigate to the **Ecosystem** → **Installed Operators** page and inspect the `Status` column for any errors or failures.
2. Navigate to the **Workloads** → **Pods** page and check the logs in any pods in the `openshift-security-profiles` project that are reporting issues.

## Installing the Security Profiles Operator using the CLI {#spo-installing-cli_spo-enabling}

You can install the OpenShift Container Platform Security Profiles Operator by using the command line interface.

**Prerequisites**

- You must have `cluster-admin` privileges.

**Procedure**

1. Define a `Namespace` object:

   ```yaml {title="Example namespace-object.yaml"}
   apiVersion: v1
   kind: Namespace
   metadata:
       name: openshift-security-profiles
   labels:
     openshift.io/cluster-monitoring: "true"
   ```
2. Create the `Namespace` object:

   ```terminal
   $ oc create -f namespace-object.yaml
   ```
3. Define an `OperatorGroup` object:

   ```yaml {title="Example operator-group-object.yaml"}
   apiVersion: operators.coreos.com/v1
   kind: OperatorGroup
   metadata:
     name: security-profiles-operator
     namespace: openshift-security-profiles
   ```
4. Create the `OperatorGroup` object:

   ```terminal
   $ oc create -f operator-group-object.yaml
   ```
5. Define a `Subscription` object:

   ```yaml {title="Example subscription-object.yaml"}
   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: security-profiles-operator-sub
     namespace: openshift-security-profiles
   spec:
     channel: release-alpha-rhel-8
     installPlanApproval: Automatic
     name: security-profiles-operator
     source: redhat-operators
     sourceNamespace: openshift-marketplace
   ```
6. Create the `Subscription` object:

   ```terminal
   $ oc create -f subscription-object.yaml
   ```

   > [!NOTE]
   > If you are setting the global scheduler feature and enable `defaultNodeSelector`, you must create the namespace manually and update the annotations of the `openshift-security-profiles` namespace, or the namespace where the Security Profiles Operator was installed, with `openshift.io/node-selector: “”`. This removes the default node selector and prevents deployment failures.

**Verification**

1. Verify the installation succeeded by inspecting the following CSV file:

   ```terminal
   $ oc get csv -n openshift-security-profiles
   ```
2. Verify that the Security Profiles Operator is operational by running the following command:

   ```terminal
   $ oc get deploy -n openshift-security-profiles
   ```

## Configuring logging verbosity {#logging-verbosity_spo-enabling}

The Security Profiles Operator supports the default logging verbosity of `0` and an enhanced verbosity of `1`.

**Procedure**

- To enable enhanced logging verbosity, patch the `spod` configuration and adjust the value by running the following command:

  ```terminal
  $ oc -n openshift-security-profiles patch spod \
      spod --type=merge -p '{"spec":{"verbosity":1}}'
  ```

  ```terminal {title="Example output"}
  securityprofilesoperatordaemon.security-profiles-operator.x-k8s.io/spod patched
  ```