Repository: tektoncd/operator
Pull request #1118 (2022-10-19 11:03:58)

Remove seccompprofile from deployments of operands
This will remove seccomp profile fields which we added for
all operands created by operator so that operator can work fine
on 4.10 along with 4.11 and 4.12

# Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

- [ ] Run `make test lint` before submitting a PR
- [ ] Includes [tests](https://github.com/tektoncd/community/blob/master/standards.md#principles) (if functionality changed/added)
- [ ] Includes [docs](https://github.com/tektoncd/community/blob/master/standards.md#principles) (if user facing)
- [ ] Commit messages follow [commit message best practices](https://github.com/tektoncd/community/blob/master/standards.md#commit-messages)

_See [the contribution guide](https://github.com/tektoncd/operator/blob/master/CONTRIBUTING.md) for more details._

# Release Notes

```release-note
Remove seccompprofile from deployments of operands
```


tekton-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by:
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please assign **savitaashture** after the PR has been reviewed.
You can assign the PR to them by writing `/assign @savitaashture` in a comment when ready.

The full list of commands accepted by this bot can be found [here](https://prow.tekton.dev/command-help?repo=tektoncd%2Foperator).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/tektoncd/operator/blob/release-v0.60.x/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["savitaashture"]} -->
rupalibehera: cc: @vdemeester 
tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/openshift/common/transformer.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1118/pull-tekton-operator-go-coverage/1582689013003718656/artifacts/line-cov.html#file1) | 79.2% | 61.7% | -17.5

tekton-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/tektoncd/operator/pull/1118#pullrequestreview-1147929392" title="Approved">vdemeester</a>*

The full list of commands accepted by this bot can be found [here](https://prow.tekton.dev/command-help?repo=tektoncd%2Foperator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/tektoncd/operator/blob/release-v0.60.x/OWNERS)~~ [vdemeester]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
tekton-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/tektoncd/operator/pull/1118#pullrequestreview-1148707568" title="LGTM">concaf</a>*, *<a href="https://github.com/tektoncd/operator/pull/1118#pullrequestreview-1147929392" title="Approved">vdemeester</a>*

The full list of commands accepted by this bot can be found [here](https://prow.tekton.dev/command-help?repo=tektoncd%2Foperator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/tektoncd/operator/blob/release-v0.60.x/OWNERS)~~ [concaf,vdemeester]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->

Patch:
diff --git a/cmd/openshift/operator/kodata/tekton-addon/addons/05-tkncliserve/tkn_cli_serve.yaml b/cmd/openshift/operator/kodata/tekton-addon/addons/05-tkncliserve/tkn_cli_serve.yaml
index f7ea74612..a60c87d0e 100644
--- a/cmd/openshift/operator/kodata/tekton-addon/addons/05-tkncliserve/tkn_cli_serve.yaml
+++ b/cmd/openshift/operator/kodata/tekton-addon/addons/05-tkncliserve/tkn_cli_serve.yaml
@@ -18,8 +18,6 @@ spec:
     spec:
       securityContext:
         runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
       containers:
         - name: tkn-cli-serve
           image: docker.io/rupali/serve-tkn:v2
diff --git a/cmd/openshift/operator/kodata/webhook/webhook.yaml b/cmd/openshift/operator/kodata/webhook/webhook.yaml
index 89dab49c7..9ab9bd39b 100644
--- a/cmd/openshift/operator/kodata/webhook/webhook.yaml
+++ b/cmd/openshift/operator/kodata/webhook/webhook.yaml
@@ -101,8 +101,6 @@ spec:
     spec:
       securityContext:
         runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
       serviceAccountName: tekton-operators-proxy-webhook
       containers:
         - name: proxy
diff --git a/pkg/reconciler/common/prune.go b/pkg/reconciler/common/prune.go
index 25f52e1e1..14a3c59ca 100644
--- a/pkg/reconciler/common/prune.go
+++ b/pkg/reconciler/common/prune.go
@@ -362,9 +362,6 @@ func createCronJob(ctx context.Context, kc kubernetes.Interface, cronName, targe
 							Tolerations:        tC.Spec.Config.Tolerations,
 							SecurityContext: &corev1.PodSecurityContext{
 								RunAsNonRoot: &runAsNonRoot,
-								SeccompProfile: &corev1.SeccompProfile{
-									Type: corev1.SeccompProfileTypeRuntimeDefault,
-								},
 							},
 						},
 					},
diff --git a/pkg/reconciler/openshift/common/transformer.go b/pkg/reconciler/openshift/common/transformer.go
index a6aea416b..5a99a4553 100644
--- a/pkg/reconciler/openshift/common/transformer.go
+++ b/pkg/reconciler/openshift/common/transformer.go
@@ -139,11 +139,6 @@ func AddDeploymentRestrictedPSA() mf.Transformer {
 		}
 		d.Spec.Template.Spec.SecurityContext.RunAsNonRoot = &runAsNonRoot
 
-		if d.Spec.Template.Spec.SecurityContext.SeccompProfile == nil {
-			d.Spec.Template.Spec.SecurityContext.SeccompProfile = &corev1.SeccompProfile{}
-		}
-		d.Spec.Template.Spec.SecurityContext.SeccompProfile.Type = corev1.SeccompProfileTypeRuntimeDefault
-
 		for i := range d.Spec.Template.Spec.Containers {
 			c := &d.Spec.Template.Spec.Containers[i]
 			if c.SecurityContext == nil {
@@ -183,11 +178,6 @@ func AddJobRestrictedPSA() mf.Transformer {
 		}
 		jb.Spec.Template.Spec.SecurityContext.RunAsNonRoot = &runAsNonRoot
 
-		if jb.Spec.Template.Spec.SecurityContext.SeccompProfile == nil {
-			jb.Spec.Template.Spec.SecurityContext.SeccompProfile = &corev1.SeccompProfile{}
-		}
-		jb.Spec.Template.Spec.SecurityContext.SeccompProfile.Type = corev1.SeccompProfileTypeRuntimeDefault
-
 		for i := range jb.Spec.Template.Spec.Containers {
 			c := &jb.Spec.Template.Spec.Containers[i]
 			if c.SecurityContext == nil {


Test patch:
diff --git a/pkg/reconciler/openshift/common/testdata/test-add-psa-expected.yaml b/pkg/reconciler/openshift/common/testdata/test-add-psa-expected.yaml
index 01a289c24..2f24f46f6 100644
--- a/pkg/reconciler/openshift/common/testdata/test-add-psa-expected.yaml
+++ b/pkg/reconciler/openshift/common/testdata/test-add-psa-expected.yaml
@@ -30,8 +30,6 @@ spec:
     spec:
       securityContext:
         runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
       volumes:
         - name: catalog-source
           persistentVolumeClaim: