Repository: kubernetes-sigs/security-profiles-operator
Pull request #1853 (2023-08-29 12:04:09)

Use official packages for Fedora machine


#### What type of PR is this?


/kind cleanup


#### What this PR does / why we need it:
We now stick to the official RPM packages instead of downloading the binaries separately.

#### Which issue(s) this PR fixes:

<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.

Fixes #

or

None
-->
None
#### Does this PR have test?
None
<!--
If tests aren't applicable just write N/A.
-->

#### Special notes for your reviewer:
None
#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
None
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1853#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1853#pullrequestreview-1600255364" title="Approved">JAORMX</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1853#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [JAORMX,saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
k8s-ci-robot: New changes are detected. LGTM label has been removed.
k8s-ci-robot: @saschagrunert: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | c7370e10007e81ecc6960ba81365f76e9dbfd959 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1853/pull-security-profiles-operator-verify/1696524916582518784) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1853). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @saschagrunert: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-e2e | e0f0aba5832326ec9adde6c063b39e28cdb27d8f | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1853/pull-security-profiles-operator-test-e2e/1697213241790304256) | true | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1853). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
saschagrunert: /test pull-security-profiles-operator-test-e2e
pjbgf: /lgtm

Patch:
diff --git a/dependencies.yaml b/dependencies.yaml
index c5f84b105..4fd684f5d 100644
--- a/dependencies.yaml
+++ b/dependencies.yaml
@@ -84,13 +84,13 @@ dependencies:
   - name: e2e-kubernetes
     version: 1.28
     refPaths:
-    - path: hack/ci/install-kubernetes.sh
-      match: VERSION
+    - path: hack/ci/Vagrantfile-fedora
+      match: KUBERNETES_VERSION
     - path: hack/ci/Vagrantfile-ubuntu
       match: KUBERNETES_VERSION
 
   - name: e2e-fedora
-    version: 36
+    version: 38
     refPaths:
     - path: hack/ci/Vagrantfile-fedora
       match: fedora
@@ -199,12 +199,6 @@ dependencies:
     - path: installation-usage.md
       match: baseProfileName
 
-  - name: audit2rbac
-    version: v0.10.0
-    refPaths:
-    - path: hack/ci/install-audit2rbac.sh
-      match: VERSION
-
   - name: cosign
     version: v2.0.2
     refPaths:
diff --git a/hack/ci/Vagrantfile-fedora b/hack/ci/Vagrantfile-fedora
index 690c0b1e4..f25a8afbc 100644
--- a/hack/ci/Vagrantfile-fedora
+++ b/hack/ci/Vagrantfile-fedora
@@ -3,7 +3,7 @@
 
 # Vagrant box for testing
 Vagrant.configure("2") do |config|
-  config.vm.box = "fedora/36-cloud-base"
+  config.vm.box = "fedora/38-cloud-base"
   memory = 8192
   cpus = 4
 
@@ -32,32 +32,45 @@ Vagrant.configure("2") do |config|
       echo 'export GOPATH="$HOME/go"' >> /etc/profile
       echo 'export GOBIN="$GOPATH/bin"' >> /etc/profile
 
-      dnf upgrade -y
+      KUBERNETES_VERSION=v1.28
+      cat <<EOF | tee /etc/yum.repos.d/kubernetes.repo
+[kubernetes]
+name=Kubernetes
+baseurl=https://pkgs.k8s.io/core:/stable:/$KUBERNETES_VERSION/rpm/
+enabled=1
+gpgcheck=1
+gpgkey=https://pkgs.k8s.io/core:/stable:/$KUBERNETES_VERSION/rpm/repodata/repomd.xml.key
+EOF
+
       dnf install -y \
         conntrack \
         container-selinux \
+        gcc \
         git \
         iptables \
         jq \
+        kubeadm \
+        kubectl \
+        kubelet \
         make \
-        gcc \
         openssl \
         podman
 
+      dnf remove -y \
+        zram-generator-defaults
+
+      hostnamectl set-hostname fedora
 
       # Configure system to work seamlessly on single node clusters
       modprobe br_netfilter
       ip6tables --list >/dev/null
       iptables -F
       sysctl -w net.ipv4.conf.all.route_localnet=1
-      sysctl -w net.ipv4.ip_forward=1
       sysctl -w net.bridge.bridge-nf-call-iptables=1
       sysctl -w fs.inotify.max_user_watches=1048576
       iptables -t nat -I POSTROUTING -s 127.0.0.0/8 ! -d 127.0.0.0/8 -j MASQUERADE
+      systemctl stop dev-zram0.swap
 
-      podman load -i /vagrant/image.tar
-      /vagrant/hack/ci/install-audit2rbac.sh
-      /vagrant/hack/ci/install-cri-o.sh
       /vagrant/hack/ci/install-kubernetes.sh
     SHELL
   end
diff --git a/hack/ci/Vagrantfile-ubuntu b/hack/ci/Vagrantfile-ubuntu
index dcb2d21d0..3171ee4a0 100644
--- a/hack/ci/Vagrantfile-ubuntu
+++ b/hack/ci/Vagrantfile-ubuntu
@@ -49,25 +49,7 @@ Vagrant.configure("2") do |config|
       sysctl -w kernel.printk_ratelimit=0
       sysctl -w kernel.printk_ratelimit_burst=0
 
-      podman load -i /vagrant/image.tar
-      /vagrant/hack/ci/install-cri-o.sh
-
-      # Setup cluster
-      IP=`ip route get 1.2.3.4 | cut -d ' ' -f7 | tr -d '[:space:]'`
-      NODENAME=$(hostname -s)
-      swapoff -a
-      modprobe br_netfilter
-      sysctl -w net.ipv4.ip_forward=1
-      kubeadm init --apiserver-cert-extra-sans=$IP --node-name $NODENAME
-
-      # Setup kubectl
-      mkdir /home/vagrant/.kube
-      cp /etc/kubernetes/admin.conf /home/vagrant/.kube/config
-      chown -R vagrant:vagrant /home/vagrant/.kube
-
-      # Configure cluster
-      export KUBECONFIG=/etc/kubernetes/admin.conf
-      kubectl taint nodes --all node-role.kubernetes.io/control-plane-
+      /vagrant/hack/ci/install-kubernetes.sh
     SHELL
   end
 end
diff --git a/hack/ci/env-fedora.sh b/hack/ci/env-fedora.sh
deleted file mode 100755
index 026684d42..000000000
--- a/hack/ci/env-fedora.sh
+++ /dev/null
@@ -1,34 +0,0 @@
-# Copyright 2021 The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-local_ip() {
-    ip route get 1.2.3.4 | cut -d ' ' -f7 | tr -d '[:space:]'
-}
-
-export PATH="/usr/local/go/bin:$PATH"
-export GOPATH="$HOME/go"
-export GOBIN="$GOPATH/bin"
-
-export KUBE_CONTAINER_RUNTIME=remote
-export KUBERUN=/var/run/kubernetes
-export KUBECONFIG=$KUBERUN/admin.kubeconfig
-export PATH="$GOPATH/src/k8s.io/kubernetes/_output/bin:$PATH"
-
-IP=$(local_ip)
-export KUBE_MASTER_URL=$IP
-export KUBE_MASTER_IP=$IP
-export KUBE_MASTER=$IP
-
-# Added for faster debugging with lower verbosity
-alias k=kubectl
diff --git a/hack/ci/env-ubuntu.sh b/hack/ci/env.sh
similarity index 100%
rename from hack/ci/env-ubuntu.sh
rename to hack/ci/env.sh
diff --git a/hack/ci/install-audit2rbac.sh b/hack/ci/install-audit2rbac.sh
deleted file mode 100755
index 81e5e29f3..000000000
--- a/hack/ci/install-audit2rbac.sh
+++ /dev/null
@@ -1,22 +0,0 @@
-#!/usr/bin/env bash
-# Copyright 2022 The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-set -euo pipefail
-
-VERSION=v0.10.0
-curl -sSfL --retry 5 --retry-delay 3 \
-    "https://github.com/liggitt/audit2rbac/releases/download/$VERSION/audit2rbac-linux-amd64.tar.gz" -o- |
-    tar xfz -
-mv audit2rbac /usr/bin
diff --git a/hack/ci/install-kubernetes.sh b/hack/ci/install-kubernetes.sh
index 61f605332..710bd615d 100755
--- a/hack/ci/install-kubernetes.sh
+++ b/hack/ci/install-kubernetes.sh
@@ -13,67 +13,34 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-set -euo pipefail
-
-ENVFILE=$(dirname "${BASH_SOURCE[0]}")/env-fedora.sh
-. "$ENVFILE"
-
-K8SPATH="$GOPATH/src/k8s.io"
-VERSION=v1.28.0
-
-download-kubernetes() {
-    export KUBERNETES_RELEASE=$VERSION
-    export KUBERNETES_SKIP_CONFIRM=1
-    export KUBERNETES_SKIP_CREATE_CLUSTER=1
-    cluster/get-kube.sh
-
-    mkdir -p _output/bin
-    tar xfz kubernetes/server/kubernetes-server-linux-amd64.tar.gz
-    cp kubernetes/server/bin/{kubectl,kube-apiserver,kube-controller-manager,kube-proxy,kube-scheduler,kubelet} \
-        _output/bin
-}
-
-local-up() {
-    export PATH="$GOPATH/src/k8s.io/kubernetes/third_party/etcd:$PATH"
-    export CONTAINER_RUNTIME=remote
-    export CGROUP_DRIVER=systemd
-    export CONTAINER_RUNTIME_ENDPOINT=/var/run/crio/crio.sock
-    export CGROUPS_PER_QOS=false
-    export ALLOW_PRIVILEGED=1
-    export KUBELET_FLAGS='--enforce-node-allocatable='
-
-    echo "Using IP: $IP"
-    export DNS_SERVER_IP=$IP
-    export API_HOST_IP=$IP
-
-    iptables -F
-    download-kubernetes
-    hack/local-up-cluster.sh -O
-}
-
-mkdir -p "$K8SPATH"
-cd "$K8SPATH"
-
-TARBALL=k8s.tar.gz
-curl -sfL --retry 5 --retry-delay 3 --show-error \
-    -o $TARBALL https://github.com/kubernetes/kubernetes/tarball/$VERSION
-tar xfz $TARBALL
-rm $TARBALL
-mv kubernetes-kubernetes-* kubernetes
-cd kubernetes
-
-hack/install-etcd.sh
-
-OUTPUT=$(mktemp)
-local-up 2>&1 | tee "$OUTPUT" &
-PID=$!
-
-echo Waiting for hack/local-up-cluster.sh
-until grep -q "Local Kubernetes cluster is running" "$OUTPUT"; do
-    if ! ps $PID >/dev/null; then
-        exit 1
-    fi
-    sleep 1
-done
-
-echo Cluster is up and running
+set -euox pipefail
+
+USER=vagrant
+ROOT_DIR=/$USER
+
+# Prepare dependents
+podman load -i $ROOT_DIR/image.tar
+$ROOT_DIR/hack/ci/install-cri-o.sh
+
+# Setup cluster
+IP=$(ip route get 1.2.3.4 | cut -d ' ' -f7 | tr -d '[:space:]')
+NODENAME=$(hostname -s)
+swapoff -a
+modprobe br_netfilter
+sysctl -w net.ipv4.ip_forward=1
+kubeadm init --apiserver-cert-extra-sans="$IP" --node-name "$NODENAME"
+
+# Setup kubectl
+mkdir /home/$USER/.kube
+cp /etc/kubernetes/admin.conf /home/$USER/.kube/config
+chown -R $USER:$USER /home/$USER/.kube
+
+mkdir /root/.kube
+cp /etc/kubernetes/admin.conf /root/.kube/config
+
+# Configure cluster
+export KUBECONFIG=/etc/kubernetes/admin.conf
+kubectl taint nodes --all node-role.kubernetes.io/control-plane-
+kubectl wait -n kube-system --timeout=180s --for=condition=available deploy coredns
+kubectl wait --timeout=180s --for=condition=ready pods --all -A
+kubectl get pods -A
diff --git a/hack/ci/print-rbac.sh b/hack/ci/print-rbac.sh
deleted file mode 100755
index 8f9abcb41..000000000
--- a/hack/ci/print-rbac.sh
+++ /dev/null
@@ -1,25 +0,0 @@
-#!/usr/bin/env bash
-# Copyright 2022 The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-set -euo pipefail
-
-AUDIT_LOG=/tmp/kube-apiserver-audit.log
-NAMESPACE=security-profiles-operator
-declare -a SERVICE_ACCOUNTS=(security-profiles-operator spod spo-webhook)
-
-for SA in "${SERVICE_ACCOUNTS[@]}"; do
-    echo "Generating RBAC for serviceaccount $SA"
-    audit2rbac -f $AUDIT_LOG --serviceaccount "$NAMESPACE:$SA"
-done
diff --git a/hack/ci/run-fedora.sh b/hack/ci/run-fedora.sh
index 4927f2790..6967eb20b 100755
--- a/hack/ci/run-fedora.sh
+++ b/hack/ci/run-fedora.sh
@@ -15,4 +15,4 @@
 
 set -euo pipefail
 
-exec vagrant ssh -- sudo "bash -c 'cd /vagrant && . hack/ci/env-fedora.sh && $*'"
+exec vagrant ssh -- sudo "bash -c 'cd /vagrant && . hack/ci/env.sh && $*'"
diff --git a/hack/ci/run-ubuntu.sh b/hack/ci/run-ubuntu.sh
index 75d702d81..d96dc7c48 100755
--- a/hack/ci/run-ubuntu.sh
+++ b/hack/ci/run-ubuntu.sh
@@ -15,4 +15,4 @@
 
 set -euo pipefail
 
-exec vagrant ssh -- "bash -c 'cd /vagrant && . hack/ci/env-ubuntu.sh && $*'"
+exec vagrant ssh -- "bash -c 'cd /vagrant && . hack/ci/env.sh && $*'"


Test patch:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 5f1bf2bfe..26506b40a 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -77,7 +77,7 @@ jobs:
         run: make vagrant-up-fedora
       - name: Show environment information
         run: |
-          $RUN kubectl wait --for=condition=ready --timeout=60s node 127.0.0.1
+          $RUN kubectl wait --for=condition=ready --timeout=60s node fedora
           $RUN kubectl get nodes -o wide
       - name: Set up git config
         run: |
@@ -87,10 +87,8 @@ jobs:
       - name: Run Flaky E2E tests
         continue-on-error: true
         run: |
-          $RUN "echo \"export E2E_TEST_FLAKY_TESTS_ONLY=true\" >> /vagrant/hack/ci/env-fedora.sh"
+          $RUN "echo \"export E2E_TEST_FLAKY_TESTS_ONLY=true\" >> /vagrant/hack/ci/env.sh"
           $RUN hack/ci/e2e-fedora.sh
-      - name: Print generated RBAC rules
-        run: $RUN hack/ci/print-rbac.sh
 
   e2e-ubuntu:
     needs: image
@@ -124,7 +122,7 @@ jobs:
       - name: Run Flaky E2E tests
         continue-on-error: true
         run: |
-          $RUN "echo \"export E2E_TEST_FLAKY_TESTS_ONLY=true\" >> /vagrant/hack/ci/env-ubuntu.sh"
+          $RUN "echo \"export E2E_TEST_FLAKY_TESTS_ONLY=true\" >> /vagrant/hack/ci/env.sh"
           $RUN hack/ci/e2e-ubuntu.sh
 
   e2e-flatcar: