Repository: kubernetes-sigs/security-profiles-operator
Pull request #2112 (2024-02-06 09:53:41)

Bump test Kubernetes to v1.29


#### What type of PR is this?


/kind cleanup


#### What this PR does / why we need it:
Updating kind and the Kubernetes version used in our e2e tests.
#### Which issue(s) this PR fixes:

<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.

Fixes #

or

None
-->
None
#### Does this PR have test?
None
<!--
If tests aren't applicable just write N/A.
-->

#### Special notes for your reviewer:
None
#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
None
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/2112#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->

Patch:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 8c0204888..4f4c2d7b4 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -37,7 +37,7 @@ jobs:
           authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
           pushFilter: security-profiles-operator
       - run: make nix
-      - uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
+      - uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
         with:
           name: build
           path: build.tar.gz
@@ -64,7 +64,7 @@ jobs:
             https://github.com/kubernetes-sigs/bom/releases/download/${{ env.BOM_VERSION }}/bom-amd64-linux
           sudo chmod +x /usr/bin/bom
       - run: make nix-spoc
-      - uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
+      - uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
         with:
           name: spoc
           path: |
@@ -134,7 +134,7 @@ jobs:
           # Only load on PR builds
           load: ${{ github.ref != 'refs/heads/main' }}
       - name: Run container image vulnerability scanner
-        uses: aquasecurity/trivy-action@d43c1f16c00cfd3978dde6c07f4bbcf9eb6993ca
+        uses: aquasecurity/trivy-action@84384bd6e777ef152729993b8145ea352e9dd3ef
         with:
           image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
           format: 'table'
@@ -178,7 +178,7 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           load: true
       - name: Run container image vulnerability scanner
-        uses: aquasecurity/trivy-action@d43c1f16c00cfd3978dde6c07f4bbcf9eb6993ca
+        uses: aquasecurity/trivy-action@84384bd6e777ef152729993b8145ea352e9dd3ef
         with:
           image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
           format: 'table'
@@ -224,7 +224,7 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           load: true
       - name: Run container image vulnerability scanner
-        uses: aquasecurity/trivy-action@d43c1f16c00cfd3978dde6c07f4bbcf9eb6993ca
+        uses: aquasecurity/trivy-action@84384bd6e777ef152729993b8145ea352e9dd3ef
         with:
           image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
           format: 'table'
diff --git a/.github/workflows/helm-chart-package.yaml b/.github/workflows/helm-chart-package.yaml
index d07dddcaf..8726d7113 100644
--- a/.github/workflows/helm-chart-package.yaml
+++ b/.github/workflows/helm-chart-package.yaml
@@ -28,7 +28,7 @@ jobs:
           [ ! -f "${tgz_path}" ] && echo "failed to find helm chart from 'helm package' stdout" && exit 1
           echo "helm_tgz_path=${tgz_path}" >> $GITHUB_OUTPUT
           echo "helm_tgz_name=${tgz_path##*/}" >> $GITHUB_OUTPUT
-      - uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
+      - uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
         with:
           name: ${{ steps.package.outputs.helm_tgz_name}}
           path: ${{ steps.package.outputs.helm_tgz_path}}
diff --git a/.github/workflows/osff.yml b/.github/workflows/osff.yml
index c00352a72..abc38eab8 100644
--- a/.github/workflows/osff.yml
+++ b/.github/workflows/osff.yml
@@ -55,7 +55,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
         with:
           name: SARIF file
           path: results.sarif
diff --git a/dependencies.yaml b/dependencies.yaml
index 15854a708..5c954ea09 100644
--- a/dependencies.yaml
+++ b/dependencies.yaml
@@ -56,13 +56,13 @@ dependencies:
       match: cert-manager/cert-manager
 
   - name: kind
-    version: 0.20.0
+    version: 0.21.0
     refPaths:
     - path: test/suite_test.go
       match: kindVersion
 
   - name: kind-image
-    version: 1.27.3
+    version: 1.29.1
     refPaths:
     - path: test/suite_test.go
       match: kindImage
@@ -76,7 +76,7 @@ dependencies:
       match: QEMUVERSION
 
   - name: e2e-kubernetes
-    version: 1.28
+    version: 1.29
     refPaths:
     - path: hack/ci/Vagrantfile-fedora
       match: KUBERNETES_VERSION
@@ -172,8 +172,6 @@ dependencies:
       match: baseProfileNameRunc
     - path: installation-usage.md
       match: baseProfileName
-    - path: hack/ci/Vagrantfile-ubuntu
-      match: RUNC_VERSION
 
   - name: cosign
     version: v2.2.1
diff --git a/hack/ci/Vagrantfile-fedora b/hack/ci/Vagrantfile-fedora
index a130c4e71..e9ba39c7d 100644
--- a/hack/ci/Vagrantfile-fedora
+++ b/hack/ci/Vagrantfile-fedora
@@ -33,7 +33,7 @@ Vagrant.configure("2") do |config|
       echo 'export GOPATH="$HOME/go"' >> /etc/profile
       echo 'export GOBIN="$GOPATH/bin"' >> /etc/profile
 
-      KUBERNETES_VERSION=v1.28
+      KUBERNETES_VERSION=v1.29
       cat <<EOF | tee /etc/yum.repos.d/kubernetes.repo
 [kubernetes]
 name=Kubernetes
diff --git a/hack/ci/Vagrantfile-ubuntu b/hack/ci/Vagrantfile-ubuntu
index aceb78094..678bbf7e6 100644
--- a/hack/ci/Vagrantfile-ubuntu
+++ b/hack/ci/Vagrantfile-ubuntu
@@ -31,7 +31,7 @@ Vagrant.configure("2") do |config|
         tar xfz - -C /usr/local
 
       # Kubernetes
-      KUBERNETES_VERSION=v1.28
+      KUBERNETES_VERSION=v1.29
       curl -fsSL https://pkgs.k8s.io/core:/stable:/$KUBERNETES_VERSION/deb/Release.key | gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg
       echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/$KUBERNETES_VERSION/deb/ /" | tee /etc/apt/sources.list.d/kubernetes.list
       curl -fsSL https://pkgs.k8s.io/addons:/cri-o:/prerelease:/main/deb/Release.key | gpg --dearmor -o /etc/apt/keyrings/cri-o-apt-keyring.gpg
@@ -55,12 +55,6 @@ Vagrant.configure("2") do |config|
       apt-get remove --purge -y podman
       apt-get autoremove -y
 
-      # Some tests require runc
-      RUNC_VERSION=v1.1.12
-      RUNC_BINARY=/usr/bin/crio-runc
-      curl -sSfL --retry 5 --retry-delay 3 "https://github.com/opencontainers/runc/releases/download/$RUNC_VERSION/runc.amd64" -o "$RUNC_BINARY"
-      chmod +x "$RUNC_BINARY"
-
       # Baseprofile recording requires cosign
       COSIGN_VERSION=v2.2.1
       COSIGN_BINARY=/usr/bin/cosign
diff --git a/internal/pkg/cli/recorder/consts.go b/internal/pkg/cli/recorder/consts.go
index 501bae7bf..0610228d1 100644
--- a/internal/pkg/cli/recorder/consts.go
+++ b/internal/pkg/cli/recorder/consts.go
@@ -51,7 +51,7 @@ const (
 	TypeApparmor Type = "apparmor"
 
 	// TypeRawAppArmor is the type indicating that we should record a raw
-	// seccomp JSON profile.
+	// apparmor JSON profile.
 	TypeRawAppArmor Type = "raw-apparmor"
 )
 
diff --git a/internal/pkg/daemon/bpfrecorder/apparmor_filters.go b/internal/pkg/daemon/bpfrecorder/apparmor_filters.go
index d231a882c..277a150bf 100644
--- a/internal/pkg/daemon/bpfrecorder/apparmor_filters.go
+++ b/internal/pkg/daemon/bpfrecorder/apparmor_filters.go
@@ -38,9 +38,13 @@ var knownLibrariesPrefixes = []string{
 var knownReadPrefixes = []string{
 	"/dev/random",
 	"/dev/urandom",
+	"/etc/ld.so.cache",
+	"/etc/ld.so.conf",
+	"/etc/ld.so.conf.d/",
 	"/etc/locale/",
 	"/etc/locale.alias/",
 	"/etc/localtime",
+	"/sys/kernel/mm/transparent_hugepage/hpage_pmd_size",
 	"/usr/share/locale/",
 }
 
diff --git a/internal/pkg/daemon/bpfrecorder/bpfrecorder.go b/internal/pkg/daemon/bpfrecorder/bpfrecorder.go
index 80467bf6c..ea1ddba13 100644
--- a/internal/pkg/daemon/bpfrecorder/bpfrecorder.go
+++ b/internal/pkg/daemon/bpfrecorder/bpfrecorder.go
@@ -81,6 +81,9 @@ const (
 	sockDgram           int           = 2
 	sockRaw             int           = 3
 	sockTypeMask        int           = 0xF
+	fdStdin             uint64        = 0
+	fdStdout            uint64        = 1
+	fdStderr            uint64        = 2
 )
 
 // BpfRecorder is the main structure of this package.
@@ -118,7 +121,7 @@ type BpfRecorder struct {
 
 type bpfAppArmorEvent struct {
 	Pid   uint32
-	Mtns  uint32
+	Mntns uint32
 	Type  uint8
 	Flags uint64
 	Fd    uint64
@@ -767,11 +770,11 @@ func fileDataToString(data *[pathMax]uint8) string {
 
 func (b *BpfRecorder) handleMmapEvent(fileEvent *bpfAppArmorEvent) {
 	path, ok := b.fdMapping[fileEvent.Fd]
-	if int(fileEvent.Fd) < 0 {
+	if int32(fileEvent.Fd) < 0 {
 		return
 	}
 	if !ok {
-		b.logger.Info(fmt.Sprintf("Got event for unknown fd: %d", fileEvent.Fd))
+		b.logger.Info(fmt.Sprintf("Got mmap event for unknown fd: %d", fileEvent.Fd))
 		return
 	}
 	for i, file := range b.recordedFiles {
@@ -791,12 +794,15 @@ func (b *BpfRecorder) handleMmapEvent(fileEvent *bpfAppArmorEvent) {
 }
 
 func (b *BpfRecorder) handleWrite(fileEvent *bpfAppArmorEvent) {
-	if int(fileEvent.Fd) < 0 {
+	if int32(fileEvent.Fd) < 0 {
 		return
 	}
 	path, ok := b.fdMapping[fileEvent.Fd]
 	if !ok {
-		b.logger.Info(fmt.Sprintf("Got event for unknown fd: %d", fileEvent.Fd))
+		isStdoutStderr := fileEvent.Fd == fdStdout || fileEvent.Fd == fdStderr
+		if !isStdoutStderr {
+			b.logger.Info(fmt.Sprintf("Got write event for unknown fd: %d", fileEvent.Fd))
+		}
 		return
 	}
 	for i, file := range b.recordedFiles {
@@ -808,12 +814,15 @@ func (b *BpfRecorder) handleWrite(fileEvent *bpfAppArmorEvent) {
 }
 
 func (b *BpfRecorder) handleRead(fileEvent *bpfAppArmorEvent) {
-	if int(fileEvent.Fd) < 0 {
+	if int32(fileEvent.Fd) < 0 {
 		return
 	}
 	path, ok := b.fdMapping[fileEvent.Fd]
 	if !ok {
-		b.logger.Info(fmt.Sprintf("Got event for unknown fd: %d", fileEvent.Fd))
+		isStdin := fileEvent.Fd == fdStdin
+		if !isStdin {
+			b.logger.Info(fmt.Sprintf("Got read event for unknown fd: %d", fileEvent.Fd))
+		}
 		return
 	}
 	for i, file := range b.recordedFiles {
@@ -833,7 +842,7 @@ func (b *BpfRecorder) handleAppArmorFileEvents(fileEvent *bpfAppArmorEvent) {
 		var fileEv bpfAppArmorFileEvent
 		fileEv.Filename = fileDataToString(&fileEvent.Data)
 		fileEv.Flags = fileEvent.Flags
-		if int(fileEvent.Fd) < 0 {
+		if int32(fileEvent.Fd) < 0 {
 			fileEv.GotError = true
 		}
 		b.recordedFiles = append(b.recordedFiles, fileEv)


Test patch:
diff --git a/.github/workflows/olm_tests.yaml b/.github/workflows/olm_tests.yaml
index d3397d949..b2bad3845 100644
--- a/.github/workflows/olm_tests.yaml
+++ b/.github/workflows/olm_tests.yaml
@@ -6,7 +6,7 @@ on:
   pull_request:
 env:
   GO_VERSION: '1.21'
-  KIND_IMG_TAG: v1.27.3
+  KIND_IMG_TAG: v1.29.1
 
 permissions: {}
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 68d44aed1..c2e6a364b 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -50,7 +50,7 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v3.5.2
       - run: make image
       - run: podman save -o image.tar security-profiles-operator
-      - uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8
+      - uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3
         with:
           name: image
           path: image.tar
diff --git a/test/suite_test.go b/test/suite_test.go
index 4c2d312a3..8358ec5bf 100644
--- a/test/suite_test.go
+++ b/test/suite_test.go
@@ -39,10 +39,10 @@ import (
 )
 
 const (
-	kindVersion      = "v0.20.0"
-	kindImage        = "kindest/node:v1.27.3@sha256:3966ac761ae0136263ffdb6cfd4db23ef8a83cba8a463690e98317add2c9ba72"
-	kindDarwinSHA512 = "d3edf9ee8e5d0f537a4be4c2f1b155755e969f3dd7738f13ce4262ed8252adeb4575542e73c44541c666bc2c95d0c37cc791b16d2f13ad83ee39ed381db9b869" //nolint:lll // full length SHA
-	kindLinuxSHA512  = "0ecebe8f0bdacd932a9ea2e6de4e1577ce4b5017c6fea289855db2c7f4f538f86236ed77332f46f805b5867e2b8c123155d1908bb5605cc4a9d2f94b39427c3c" //nolint:lll // full length SHA
+	kindVersion      = "v0.21.0"
+	kindImage        = "kindest/node:v1.29.1@sha256:a0cc28af37cf39b019e2b448c54d1a3f789de32536cb5a5db61a49623e527144"
+	kindDarwinSHA512 = "647ff18247ad9c47fd5346be98db83244e6d6110a0b2766d27c96c6ebb38c77f4fa7002345277aac9ec9252481277e329e7fc49a2ee395e1977900ee008034f0" //nolint:lll // full length SHA
+	kindLinuxSHA512  = "0e8c56a2c87bacded1696ed3caf20c068981810e6f31c5907d4228cca671330f5641312e78cae0a148e6cbaddfe7b9092194132c3f420bf0463a8af7e167482f" //nolint:lll // full length SHA
 )
 
 var (