Repository: kubernetes-sigs/security-profiles-operator
Pull request #2091 (2024-01-30 09:20:14)

Re-enable Fedora Vagrant based tests


#### What type of PR is this?


/kind failing-test


#### What this PR does / why we need it:
Enabling the Fedora based tests again while fixing CI.
#### Which issue(s) this PR fixes:

<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.

Fixes #

or

None
-->
None
#### Does this PR have test?
None
<!--
If tests aren't applicable just write N/A.
-->

#### Special notes for your reviewer:
None
#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
None
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/2091#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
codecov-commenter: ## [Codecov](https://app.codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/2091?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kubernetes-sigs) Report
> Merging [#2091](https://app.codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/2091?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kubernetes-sigs) (ab51753) into [main](https://app.codecov.io/gh/kubernetes-sigs/security-profiles-operator/commit/dfe448b77266786b69a08dc27ead96efe81329ad?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kubernetes-sigs) (dfe448b) will **not change** coverage.
> Report is 3 commits behind head on main.
> The diff coverage is `n/a`.

<details><summary>Additional details and impacted files</summary>


```diff
@@           Coverage Diff           @@
##             main    #2091   +/-   ##
=======================================
  Coverage   45.50%   45.50%           
=======================================
  Files          79       79           
  Lines        7782     7782           
=======================================
  Hits         3541     3541           
  Misses       4099     4099           
  Partials      142      142           
```

</details>
saschagrunert: @kubernetes-sigs/security-profiles-operator-maintainers PTAL

Patch:
diff --git a/dependencies.yaml b/dependencies.yaml
index 0ace696d8..fbb66da57 100644
--- a/dependencies.yaml
+++ b/dependencies.yaml
@@ -156,7 +156,7 @@ dependencies:
       match: VERSION
 
   - name: crun
-    version: v1.12
+    version: v1.14
     refPaths:
     - path: examples/baseprofile-crun.yaml
       match: name
@@ -164,7 +164,7 @@ dependencies:
       match: baseProfileNameCrun
 
   - name: runc
-    version: v1.1.9
+    version: v1.1.11
     refPaths:
     - path: examples/baseprofile-runc.yaml
       match: name
diff --git a/examples/baseprofile-crun.yaml b/examples/baseprofile-crun.yaml
index 812277f2d..2fbc0aa91 100644
--- a/examples/baseprofile-crun.yaml
+++ b/examples/baseprofile-crun.yaml
@@ -2,7 +2,7 @@
 apiVersion: security-profiles-operator.x-k8s.io/v1beta1
 kind: SeccompProfile
 metadata:
-  name: crun-v1.12
+  name: crun-v1.14
 spec:
   defaultAction: SCMP_ACT_ERRNO
   architectures:
diff --git a/examples/baseprofile-runc.yaml b/examples/baseprofile-runc.yaml
index 96bf5e98d..883cb7287 100644
--- a/examples/baseprofile-runc.yaml
+++ b/examples/baseprofile-runc.yaml
@@ -2,7 +2,7 @@
 apiVersion: security-profiles-operator.x-k8s.io/v1beta1
 kind: SeccompProfile
 metadata:
-  name: runc-v1.1.9
+  name: runc-v1.1.11
 spec:
   defaultAction: SCMP_ACT_ERRNO
   architectures:
diff --git a/hack/ci/Vagrantfile-ubuntu b/hack/ci/Vagrantfile-ubuntu
index 79b60b162..93bb12643 100644
--- a/hack/ci/Vagrantfile-ubuntu
+++ b/hack/ci/Vagrantfile-ubuntu
@@ -56,8 +56,8 @@ Vagrant.configure("2") do |config|
       apt-get autoremove -y
 
       # Some tests require runc
-      RUNC_VERSION=v1.1.9
-      RUNC_BINARY=/usr/sbin/runc
+      RUNC_VERSION=v1.1.11
+      RUNC_BINARY=/usr/bin/crio-runc
       curl -sSfL --retry 5 --retry-delay 3 "https://github.com/opencontainers/runc/releases/download/$RUNC_VERSION/runc.amd64" -o "$RUNC_BINARY"
       chmod +x "$RUNC_BINARY"
 
@@ -69,7 +69,6 @@ Vagrant.configure("2") do |config|
 
       # Setup CRI-O
       apt-get install -y cri-o
-      printf '[crio.runtime.runtimes.runc]\n' >/etc/crio/crio.conf.d/10-runc.conf
       systemctl enable --now crio
 
       # Disable kernel print rate limiting for syslog messaging
diff --git a/hack/ci/baseprofiles.sh b/hack/ci/baseprofiles.sh
index ff702b289..29b3ba7ea 100755
--- a/hack/ci/baseprofiles.sh
+++ b/hack/ci/baseprofiles.sh
@@ -163,7 +163,7 @@ EOT
         )" "$BASEPROFILE"
 
         echo "Getting runtime version"
-        VERSION=$($RUNTIME --version | grep "$RUNTIME version" | grep -oP '\d+.*')
+        VERSION=$(crio-"$RUNTIME" --version | grep "$RUNTIME version" | grep -oP '\d+.*')
         yq -i '.metadata.name = "'"$RUNTIME"'-v'"$VERSION"'"' "$BASEPROFILE"
 
         echo "Deleting seccomp profile"
@@ -175,7 +175,7 @@ EOT
 
     for RUNTIME in "${RUNTIMES[@]}"; do
         echo "Verifying that the profile for runtime $RUNTIME is available in the GitHub container registry"
-        VERSION=$($RUNTIME --version | grep "$RUNTIME version" | grep -oP '\d+.*')
+        VERSION=$(crio-"$RUNTIME" --version | grep "$RUNTIME version" | grep -oP '\d+.*')
         cosign verify --certificate-identity-regexp '.*' --certificate-oidc-issuer-regexp '.*' \
             "ghcr.io/security-profiles/$RUNTIME:v$VERSION"
     done
diff --git a/installation-usage.md b/installation-usage.md
index 71481203e..e979465c1 100644
--- a/installation-usage.md
+++ b/installation-usage.md
@@ -555,7 +555,7 @@ metadata:
   name: profile1
 spec:
   defaultAction: SCMP_ACT_ERRNO
-  baseProfileName: oci://ghcr.io/security-profiles/runc:v1.1.9
+  baseProfileName: oci://ghcr.io/security-profiles/runc:v1.1.11
 ```
 
 The resulting profile `profile1` will then contain all base syscalls from the
@@ -1962,18 +1962,18 @@ The `spoc` client is able to pull security profiles from OCI artifact compatible
 registries. To do that, just run `spoc pull`:
 
 ```console
-> spoc pull ghcr.io/security-profiles/runc:v1.1.9
-16:32:29.795597 Pulling profile from: ghcr.io/security-profiles/runc:v1.1.9
+> spoc pull ghcr.io/security-profiles/runc:v1.1.11
+16:32:29.795597 Pulling profile from: ghcr.io/security-profiles/runc:v1.1.11
 16:32:29.795610 Verifying signature
 
-Verification for ghcr.io/security-profiles/runc:v1.1.9 --
+Verification for ghcr.io/security-profiles/runc:v1.1.11 --
 The following checks were performed on each of these signatures:
   - Existence of the claims in the transparency log was verified offline
   - The code-signing certificate was verified using trusted certificate authority certificates
 
 [{"critical":{"identity":{"docker-reference":"ghcr.io/security-profiles/runc"},…}}]
 16:32:33.208695 Creating file store in: /tmp/pull-3199397214
-16:32:33.208713 Verifying reference: ghcr.io/security-profiles/runc:v1.1.9
+16:32:33.208713 Verifying reference: ghcr.io/security-profiles/runc:v1.1.11
 16:32:33.208718 Creating repository for ghcr.io/security-profiles/runc
 16:32:33.208742 Using tag: v1.1.4
 16:32:33.208743 Copying profile from repository
@@ -2107,8 +2107,8 @@ The Security Profiles Operator will try to pull the correct profile by using
 way, for example if a profile does not support any platform:
 
 ```
-> spoc pull ghcr.io/security-profiles/runc:v1.1.9
-11:07:14.788840 Pulling profile from: ghcr.io/security-profiles/runc:v1.1.9
+> spoc pull ghcr.io/security-profiles/runc:v1.1.11
+11:07:14.788840 Pulling profile from: ghcr.io/security-profiles/runc:v1.1.11
 11:07:14.788852 Verifying signature
 …
 11:07:17.559037 Copying profile from repository


Test patch:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 94e06d0e0..69cd3a769 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -56,8 +56,6 @@ jobs:
           path: image.tar
 
   e2e-fedora:
-    # TODO(saschagrunert): re-enable when tests are fixed
-    if: false
     needs: image
     runs-on: ubuntu-22.04
     timeout-minutes: 90
diff --git a/hack/ci/e2e-fedora.sh b/hack/ci/e2e-fedora.sh
index a16f95abe..8b08fbd44 100755
--- a/hack/ci/e2e-fedora.sh
+++ b/hack/ci/e2e-fedora.sh
@@ -16,9 +16,11 @@
 set -euo pipefail
 
 export E2E_CLUSTER_TYPE=vanilla
-export E2E_TEST_SELINUX=true
+# TODO: re-enable when SELinux tests are fixed
+export E2E_TEST_SELINUX=false
 export E2E_TEST_LOG_ENRICHER=true
 export E2E_TEST_BPF_RECORDER=true
+export E2E_SELINUXD_IMAGE=quay.io/security-profiles-operator/selinuxd-fedora
 export E2E_TEST_FLAKY_TESTS_ONLY=${E2E_TEST_FLAKY_TESTS_ONLY:-false}
 
 # These are already tested in the standard e2e test.
diff --git a/test/tc_base_profiles_test.go b/test/tc_base_profiles_test.go
index 0aef93f24..fe4cd2487 100644
--- a/test/tc_base_profiles_test.go
+++ b/test/tc_base_profiles_test.go
@@ -24,8 +24,8 @@ import (
 )
 
 const (
-	baseProfileNameRunc = "runc-v1.1.9"
-	baseProfileNameCrun = "crun-v1.12"
+	baseProfileNameRunc = "runc-v1.1.11"
+	baseProfileNameCrun = "crun-v1.14"
 )
 
 func (e *e2e) testCaseBaseProfile([]string) {