Repository: kubernetes-sigs/security-profiles-operator
Pull request #965 (2022-05-30 12:40:37)

Several fixes to our e2e test suite to allow running on OpenShift
<!--  Thanks for sending a pull request!  Here are some tips for you:

- If this is your first time, please read our contributor guidelines: https://git.k8s.io/community/contributors/guide#your-first-contribution and developer guide https://git.k8s.io/community/contributors/devel/development.md#development-guide
- Please label this pull request according to what type of issue you are addressing, especially if this is a release targeted pull request. For reference on required PR/issue labels, read here:
https://git.k8s.io/community/contributors/devel/sig-release/release.md#issuepr-kind-label
- If you want *faster* PR reviews, read how: https://git.k8s.io/community/contributors/guide/pull-requests.md#best-practices-for-faster-reviews
- If the PR is unfinished, see how to mark it: https://git.k8s.io/community/contributors/guide/pull-requests.md#marking-unfinished-pull-requests
-->

#### What type of PR is this?
/kind cleanup
/kind failing-test

<!--
Add one of the following kinds:
/kind bug
/kind documentation
/kind feature
/kind design

Optionally add one or more of the following kinds if applicable:
/kind api-change
/kind deprecation
/kind flake
/kind regression
-->

#### What this PR does / why we need it:
Due to several peculiarities of OCP, it wasn't possible to run our e2e
tests on OpenShift.

These patches allow us to run the tests on an OCP cluster (tested on 4.10).

Please see the commit messages for more details.

#### Which issue(s) this PR fixes:
None

<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.

Fixes #

or

None
-->

#### Does this PR have test?
Yes

<!--
If tests aren't applicable just write N/A.
-->

#### Special notes for your reviewer:
I'll point some inline

#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
NONE
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/965#" title="Author self-approved">jhrozek</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [jhrozek]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
k8s-ci-robot: @jhrozek: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 6552c94e386fe158b59e698fda6ac62bb7757da0 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/965/pull-security-profiles-operator-test-e2e/1531254257171304448) | true | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=965). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Ajhrozek). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
jhrozek: /test pull-security-profiles-operator-test-e2e
k8s-ci-robot: @jhrozek: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 6552c94e386fe158b59e698fda6ac62bb7757da0 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/965/pull-security-profiles-operator-test-e2e/1531267418817564672) | true | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=965). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Ajhrozek). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @jhrozek: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 2a8c01efac70aacad967cf602f48a877900f9067 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/965/pull-security-profiles-operator-test-e2e/1531373844021907456) | true | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=965). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Ajhrozek). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
saschagrunert: /retest
saschagrunert: Ah those CI tests seems legit. :thinking: 
k8s-ci-robot: @jhrozek: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 2a8c01efac70aacad967cf602f48a877900f9067 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/965/pull-security-profiles-operator-test-e2e/1531533839187316736) | true | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=965). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Ajhrozek). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: New changes are detected. LGTM label has been removed.
k8s-ci-robot: @jhrozek: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-e2e | b5cc2912afbf9130322b3bf29e5a362739daaaeb | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/965/pull-security-profiles-operator-test-e2e/1531600183928819712) | true | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=965). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Ajhrozek). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->

Patch:
diff --git a/.golangci.yml b/.golangci.yml
index 3824fd561..16ff93e6b 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -29,6 +29,7 @@ linters:
     - errchkjson
     - errname
     - errorlint
+    - execinquery
     - exhaustive
     - exportloopref
     - forcetypeassert
@@ -65,6 +66,7 @@ linters:
     - nilnil
     - noctx
     - nolintlint
+    - nosprintfhostport
     - paralleltest
     - prealloc
     - predeclared
@@ -89,12 +91,14 @@ linters:
     # - contextcheck
     # - cyclop
     # - exhaustivestruct
+    # - exhaustruct
     # - forbidigo
     # - funlen
     # - gochecknoglobals
     # - ireturn
     # - maintidx
     # - nlreturn
+    # - nonamedreturns
     # - testpackage
     # - varnamelen
     # - wrapcheck
@@ -206,8 +210,10 @@ linters-settings:
       - singleCaseSwitch
       - sloppyLen
       - stringConcatSimplify
+      - stringsCompare
       - switchTrue
       - timeExprSimplify
+      - todoCommentWithoutDetail
       - tooManyResultsChecker
       - typeAssertChain
       - typeDefFirst
diff --git a/Makefile b/Makefile
index add303661..39d26f3f0 100644
--- a/Makefile
+++ b/Makefile
@@ -14,7 +14,7 @@
 
 GO ?= go
 
-GOLANGCI_LINT_VERSION = v1.45.0
+GOLANGCI_LINT_VERSION = v1.46.2
 REPO_INFRA_VERSION = v0.2.5
 KUSTOMIZE_VERSION = 4.5.5
 OPERATOR_SDK_VERSION ?= v1.17.0
@@ -338,7 +338,7 @@ verify-deployments: deployments ## Verify the generated deployments
 
 .PHONY: verify-go-lint
 verify-go-lint: $(BUILD_DIR)/golangci-lint ## Verify the golang code by linting
-	$(BUILD_DIR)/golangci-lint run --build-tags $(LINT_BUILDTAGS)
+	GL_DEBUG=gocritic $(BUILD_DIR)/golangci-lint run --build-tags $(LINT_BUILDTAGS)
 
 $(BUILD_DIR)/golangci-lint:
 	export \
diff --git a/dependencies.yaml b/dependencies.yaml
index 759affa79..8e9647529 100644
--- a/dependencies.yaml
+++ b/dependencies.yaml
@@ -14,7 +14,7 @@ dependencies:
       match: GO_VERSION
 
   - name: golangci-lint
-    version: 1.45.0
+    version: 1.46.2
     refPaths:
     - path: Makefile
       match: GOLANGCI_LINT_VERSION


Test patch:
diff --git a/test/e2e_test.go b/test/e2e_test.go
index e2c234400..a3aee64bb 100644
--- a/test/e2e_test.go
+++ b/test/e2e_test.go
@@ -57,6 +57,12 @@ func (e *e2e) TestSecurityProfilesOperator() {
 	// Deploy the operator
 	e.deployOperator(manifest)
 
+	// On some distros (OCP), the SA needs to give additional
+	// roles to the workload, like the ability to use custom
+	// profiles for pods that are spawned by a replicating
+	// controller
+	e.setupRecordingSa()
+
 	// Retrieve the inputs for the test cases
 	nodes := e.getWorkerNodes()
 
diff --git a/test/recording_role.yaml b/test/recording_role.yaml
new file mode 100644
index 000000000..8d5191182
--- /dev/null
+++ b/test/recording_role.yaml
@@ -0,0 +1,14 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  creationTimestamp: null
+  name: recording
+rules:
+- apiGroups:
+  - security.openshift.io
+  resources:
+  - securitycontextconstraints
+  resourceNames:
+  - privileged
+  verbs:
+  - use
diff --git a/test/recording_role_binding.yaml b/test/recording_role_binding.yaml
new file mode 100644
index 000000000..0de6041fe
--- /dev/null
+++ b/test/recording_role_binding.yaml
@@ -0,0 +1,13 @@
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  labels:
+    app: recording
+  name: recording
+subjects:
+- kind: ServiceAccount
+  name: recording-sa
+roleRef:
+  kind: Role
+  name: recording
+  apiGroup: rbac.authorization.k8s.io
diff --git a/test/recording_sa.yaml b/test/recording_sa.yaml
new file mode 100644
index 000000000..ed288aa30
--- /dev/null
+++ b/test/recording_sa.yaml
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  creationTimestamp: null
+  name: recording-sa
diff --git a/test/suite_test.go b/test/suite_test.go
index 54c402656..17b895261 100644
--- a/test/suite_test.go
+++ b/test/suite_test.go
@@ -89,6 +89,7 @@ type e2e struct {
 	execNode               func(node string, args ...string) string
 	waitForReadyPods       func()
 	deployCertManager      func()
+	setupRecordingSa       func()
 }
 
 func defaultWaitForReadyPods(e *e2e) {
@@ -235,6 +236,7 @@ func (e *kinde2e) SetupSuite() {
 	e.e2e.execNode = e.execNodeKind
 	e.e2e.waitForReadyPods = e.waitForReadyPodsKind
 	e.e2e.deployCertManager = e.deployCertManagerKind
+	e.e2e.setupRecordingSa = e.deployRecordingSa
 	parentCwd := e.setWorkDir()
 	buildDir := filepath.Join(parentCwd, "build")
 	e.Nil(os.MkdirAll(buildDir, 0o755))
@@ -332,6 +334,7 @@ func (e *openShifte2e) SetupSuite() {
 	e.e2e.execNode = e.execNodeOCP
 	e.e2e.waitForReadyPods = e.waitForReadyPodsOCP
 	e.e2e.deployCertManager = e.deployCertManagerOCP
+	e.e2e.setupRecordingSa = e.deployRecordingSaOcp
 	e.setWorkDir()
 
 	e.kubectlPath, err = exec.LookPath("oc")
@@ -423,6 +426,13 @@ func (e *e2e) deployCertManagerOCP() {
 	// intentionally blank, OCP creates certs on its own
 }
 
+func (e *e2e) deployRecordingSaOcp() {
+	e.deployRecordingSa()
+
+	e.kubectl("create", "-f", "test/recording_role.yaml")
+	e.kubectl("create", "-f", "test/recording_role_binding.yaml")
+}
+
 func (e *vanilla) SetupSuite() {
 	var err error
 	e.logf("Setting up suite")
@@ -433,6 +443,7 @@ func (e *vanilla) SetupSuite() {
 	e.kubectlPath, err = exec.LookPath("kubectl")
 	e.e2e.waitForReadyPods = e.waitForReadyPodsVanilla
 	e.e2e.deployCertManager = e.deployCertManagerVanilla
+	e.e2e.setupRecordingSa = e.deployRecordingSa
 	e.Nil(err)
 }
 
@@ -669,3 +680,7 @@ func (e *e2e) enableLabelingPodDenials() {
 
 	e.kubectlOperatorNS("rollout", "status", "ds", "spod", "--timeout", defaultLabelPodDenialsTimeout)
 }
+
+func (e *e2e) deployRecordingSa() {
+	e.kubectl("create", "-f", "test/recording_sa.yaml")
+}
diff --git a/test/tc_allowed_syscalls_test.go b/test/tc_allowed_syscalls_test.go
index e73fa80a4..2d2aa59fb 100644
--- a/test/tc_allowed_syscalls_test.go
+++ b/test/tc_allowed_syscalls_test.go
@@ -173,7 +173,7 @@ metadata:
 spec:
   containers:
   - name: test-container
-    image: quay.io/security-profiles-operator/test-nginx:1.19.1
+    image: quay.io/security-profiles-operator/test-nginx-unprivileged:1.21
   securityContext:
     seccompProfile:
       type: Localhost
diff --git a/test/tc_bpf_recorder_test.go b/test/tc_bpf_recorder_test.go
index 9d6e2c8fe..a11f91249 100644
--- a/test/tc_bpf_recorder_test.go
+++ b/test/tc_bpf_recorder_test.go
@@ -86,7 +86,7 @@ func (e *e2e) testCaseBpfRecorderStaticPod() {
 	e.kubectl("delete", "pod", podName)
 
 	profile := e.retryGetSeccompProfile(resourceName)
-	e.Contains(profile, "setuid")
+	e.Contains(profile, "listen")
 
 	e.kubectl("delete", "-f", exampleRecordingBpfPath)
 	e.kubectl("delete", "sp", resourceName)
@@ -148,7 +148,7 @@ spec:
     spec:
       containers:
       - name: nginx
-        image: quay.io/security-profiles-operator/test-nginx:1.19.1
+        image: quay.io/security-profiles-operator/test-nginx-unprivileged:1.21
 `
 	testFile, err := os.CreateTemp("", "recording-deployment*.yaml")
 	e.Nil(err)
@@ -172,8 +172,8 @@ spec:
 
 	profile0 := e.retryGetSeccompProfile(profileName0)
 	profile1 := e.retryGetSeccompProfile(profileName1)
-	e.Contains(profile0, "setuid")
-	e.Contains(profile1, "setuid")
+	e.Contains(profile0, "listen")
+	e.Contains(profile1, "listen")
 
 	e.kubectl("delete", "-f", exampleRecordingBpfPath)
 	e.Nil(os.Remove(testFile.Name()))
@@ -211,7 +211,7 @@ func (e *e2e) createRecordingTestParallelPods() (since time.Time, podNames []str
 	since = time.Now()
 
 	for i, image := range []string{
-		"quay.io/security-profiles-operator/test-nginx:1.19.1",
+		"quay.io/security-profiles-operator/test-nginx-unprivileged:1.21",
 		"quay.io/security-profiles-operator/redis:6.2.1",
 	} {
 		podName := fmt.Sprintf("my-pod-%d", i)
diff --git a/test/tc_delete_profiles_test.go b/test/tc_delete_profiles_test.go
index 11a9dc2b2..027eb4195 100644
--- a/test/tc_delete_profiles_test.go
+++ b/test/tc_delete_profiles_test.go
@@ -46,7 +46,7 @@ metadata:
 spec:
   containers:
   - name: test-container
-    image: quay.io/security-profiles-operator/test-nginx:1.19.1
+    image: quay.io/security-profiles-operator/test-nginx-unprivileged:1.21
   securityContext:
     seccompProfile:
       type: Localhost
@@ -60,7 +60,7 @@ metadata:
 spec:
   containers:
   - name: test-container
-    image: quay.io/security-profiles-operator/test-nginx:1.19.1
+    image: quay.io/security-profiles-operator/test-nginx-unprivileged:1.21
     securityContext:
       seccompProfile:
         type: Localhost
@@ -81,7 +81,7 @@ spec:
         localhostProfile: operator/%s/delete-me.json
   containers:
   - name: test-container
-    image: quay.io/security-profiles-operator/test-nginx:1.19.1
+    image: quay.io/security-profiles-operator/test-nginx-unprivileged:1.21
 `
 		deletePodSecurityContextInAnnotation = `
 apiVersion: v1
@@ -93,7 +93,7 @@ metadata:
 spec:
   containers:
   - name: test-container
-    image: quay.io/security-profiles-operator/test-nginx:1.19.1
+    image: quay.io/security-profiles-operator/test-nginx-unprivileged:1.21
 `
 		deletePodName = "test-pod"
 	)
diff --git a/test/tc_log_enricher_test.go b/test/tc_log_enricher_test.go
index 33784a277..df193d997 100644
--- a/test/tc_log_enricher_test.go
+++ b/test/tc_log_enricher_test.go
@@ -59,7 +59,7 @@ metadata:
   name: %s
 spec:
   containers:
-  - image: quay.io/security-profiles-operator/test-nginx:1.19.1
+  - image: quay.io/security-profiles-operator/test-nginx-unprivileged:1.21
     name: %s
   securityContext:
     seccompProfile:
@@ -113,7 +113,7 @@ spec:
 		`namespace="%s",`+
 		`node=".*",`+
 		`pod="%s",`+
-		`syscall="listen"} 4`,
+		`syscall="listen"} \d+`,
 		containerName, namespace, podName,
 	), metrics)
 }
diff --git a/test/tc_profilerecordings_test.go b/test/tc_profilerecordings_test.go
index 79c0ffc9f..36bc47851 100644
--- a/test/tc_profilerecordings_test.go
+++ b/test/tc_profilerecordings_test.go
@@ -65,7 +65,7 @@ func (e *e2e) testCaseProfileRecordingStaticPodLogs() {
 	e.logEnricherOnlyTestCase()
 	e.profileRecordingStaticPod(
 		exampleRecordingSeccompLogsPath,
-		regexp.MustCompile(`(?m)"syscallName"="setuid"`),
+		regexp.MustCompile(`(?m)"syscallName"="listen"`),
 	)
 }
 
@@ -92,7 +92,8 @@ func (e *e2e) profileRecordingStaticSelinuxPod(recording string, waitConditions
 	e.kubectl("delete", "pod", podName)
 
 	resourceName := selinuxRecordingName + "-nginx"
-	pathresult := e.retryGetSelinuxJsonpath("{.spec.allow.http_port_t.tcp_socket}", resourceName)
+
+	pathresult := e.retryGetSelinuxJsonpath("{.spec.allow.http_cache_port_t.tcp_socket}", resourceName)
 	e.Contains(pathresult, "name_bind")
 
 	e.kubectl("delete", "-f", recording)
@@ -114,7 +115,7 @@ func (e *e2e) profileRecordingStaticPod(recording string, waitConditions ...*reg
 
 	resourceName := recordingName + "-nginx"
 	profile := e.retryGetSeccompProfile(resourceName)
-	e.Contains(profile, "setuid")
+	e.Contains(profile, "listen")
 
 	e.kubectl("delete", "-f", recording)
 	e.kubectl("delete", "sp", resourceName)
@@ -147,7 +148,7 @@ func (e *e2e) testCaseProfileRecordingMultiContainerLogs() {
 	e.logEnricherOnlyTestCase()
 	e.profileRecordingMultiContainer(
 		exampleRecordingSeccompLogsPath,
-		regexp.MustCompile(`(?m)"container"="nginx".*"syscallName"="setuid"`),
+		regexp.MustCompile(`(?m)"container"="nginx".*"syscallName"="listen"`),
 		regexp.MustCompile(`(?m)"container"="redis".*"syscallName"="epoll_wait"`),
 	)
 }
@@ -185,11 +186,12 @@ func (e *e2e) profileRecordingSelinuxMultiContainer(
 	e.kubectl("delete", "pod", podName)
 
 	const profileNameRedis = selinuxRecordingName + "-redis"
+
 	redispathresult := e.retryGetSelinuxJsonpath("{.spec.allow.redis_port_t.tcp_socket}", profileNameRedis)
 	e.Contains(redispathresult, "name_bind")
 
 	const profileNameNginx = selinuxRecordingName + "-nginx"
-	nginxpathresult := e.retryGetSelinuxJsonpath("{.spec.allow.http_port_t.tcp_socket}", profileNameNginx)
+	nginxpathresult := e.retryGetSelinuxJsonpath("{.spec.allow.http_cache_port_t.tcp_socket}", profileNameNginx)
 	e.Contains(nginxpathresult, "name_bind")
 
 	e.kubectl("delete", "-f", recording)
@@ -258,8 +260,8 @@ func (e *e2e) testCaseProfileRecordingDeploymentLogs() {
 	e.profileRecordingDeployment(
 		exampleRecordingSeccompLogsPath,
 		regexp.MustCompile(
-			`(?s)"container"="nginx".*"syscallName"="setuid"`+
-				`.*"container"="nginx".*"syscallName"="setuid"`),
+			`(?s)"container"="nginx".*"syscallName"="listen"`+
+				`.*"container"="nginx".*"syscallName"="listen"`),
 	)
 }
 
@@ -292,8 +294,8 @@ func (e *e2e) profileRecordingDeployment(
 	const profileName1 = recordingName + "-nginx-1"
 	profile0 := e.retryGetSeccompProfile(profileName0)
 	profile1 := e.retryGetSeccompProfile(profileName1)
-	e.Contains(profile0, "setuid")
-	e.Contains(profile1, "setuid")
+	e.Contains(profile0, "listen")
+	e.Contains(profile1, "listen")
 
 	e.kubectl("delete", "-f", recording)
 	e.kubectl("delete", "sp", profileName0, profileName1)
@@ -314,9 +316,11 @@ func (e *e2e) profileRecordingSelinuxDeployment(
 
 	const profileName0 = selinuxRecordingName + "-nginx-0"
 	const profileName1 = selinuxRecordingName + "-nginx-1"
-	profile0result := e.retryGetSelinuxJsonpath("{.spec.allow.http_port_t.tcp_socket}", profileName0)
+
+	profile0result := e.retryGetSelinuxJsonpath("{.spec.allow.http_cache_port_t.tcp_socket}", profileName0)
 	e.Contains(profile0result, "name_bind")
-	profile1result := e.retryGetSelinuxJsonpath("{.spec.allow.http_port_t.tcp_socket}", profileName1)
+
+	profile1result := e.retryGetSelinuxJsonpath("{.spec.allow.http_cache_port_t.tcp_socket}", profileName1)
 	e.Contains(profile1result, "name_bind")
 
 	e.kubectl("delete", "-f", recording)
@@ -342,9 +346,10 @@ spec:
       labels:
         app: alpine
     spec:
+      serviceAccountName: recording-sa
       containers:
       - name: nginx
-        image: quay.io/security-profiles-operator/test-nginx:1.19.1
+        image: quay.io/security-profiles-operator/test-nginx-unprivileged:1.21
 `
 
 	testFile, err := os.CreateTemp("", "recording-deployment*.yaml")
@@ -395,7 +400,7 @@ metadata:
     app: alpine
 spec:
   containers:
-  - image: quay.io/security-profiles-operator/test-nginx:1.19.1
+  - image: quay.io/security-profiles-operator/test-nginx-unprivileged:1.21
     name: nginx
   restartPolicy: Never
 `
@@ -431,7 +436,7 @@ metadata:
 spec:
   containers:
   - name: nginx
-    image: quay.io/security-profiles-operator/test-nginx:1.19.1
+    image: quay.io/security-profiles-operator/test-nginx-unprivileged:1.21
   - name: redis
     image: quay.io/security-profiles-operator/redis:6.2.1
   restartPolicy: Never
diff --git a/test/tc_spod_update_selinux_test.go b/test/tc_spod_update_selinux_test.go
index 36a8946a7..8f5058931 100644
--- a/test/tc_spod_update_selinux_test.go
+++ b/test/tc_spod_update_selinux_test.go
@@ -23,7 +23,15 @@ func (e *e2e) testCaseSPODUpdateSelinux(nodes []string) {
 
 	e.logf("assert selinux is enabled in the spod object")
 	selinuxEnabledInSPODObj := e.kubectlOperatorNS("get", "spod", "spod", "-o", "jsonpath={.spec.enableSelinux}")
-	e.Equal(selinuxEnabledInSPODObj, "true")
+	if clusterType == clusterTypeOpenShift {
+		// OCP enables SELinux by default, so both no value and explicit true are OK
+		if selinuxEnabledInSPODObj != "" && selinuxEnabledInSPODObj != "true" {
+			e.Fail("Expected that SELinux is enabled explicitly or by default on OCP")
+		}
+		e.Equal("", selinuxEnabledInSPODObj)
+	} else {
+		e.Equal("true", selinuxEnabledInSPODObj)
+	}
 
 	e.logf("assert selinux is enabled in the spod DS")
 	selinuxEnabledInSPODDS := e.kubectlOperatorNS("get", "ds", "spod", "-o", "yaml")