Repository: kubernetes-sigs/security-profiles-operator
Pull request #310 (2021-02-16 15:03:15)

Fix post-security-profiles-operator-push-image job
#### What type of PR is this?

/kind failing-test

#### What this PR does / why we need it:
The job fails because of the error message:

```
error: while setting up the build environment: \
    unable to load seccomp BPF program: Invalid argument
```

See: https://prow.k8s.io/view/gs/kubernetes-jenkins/logs/post-security-profiles-operator-push-image/1361650313655750656

Setting the option `filter-syscalls = false` in `nix.conf` seems to
solve the issue.
#### Which issue(s) this PR fixes:

<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.

Fixes #

or

None
-->
Refers to https://github.com/NixOS/nix/issues/2651
#### Does this PR have test?
Manual test:
```
> gcloud builds submit --verbosity info --config cloudbuild.yaml --substitutions _GIT_TAG=v20210216-v0.2.0-130-g9c2567b --project k8s-staging-sp-operator --gcs-log-dir gs://k8s-staging-sp-operator-gcb/logs --gcs-source-staging-dir gs://k8s-staging-sp-operator-gcb/source
```
https://console.cloud.google.com/cloud-build/builds/e32d23ff-228a-4df1-b38f-e05b8f0c3239?project=448637284062
#### Special notes for your reviewer:
None
#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
None
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/310#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/310#pullrequestreview-591314087" title="LGTM">hasheddan</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/310#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [hasheddan,saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/310#pullrequestreview-591314087" title="LGTM">hasheddan</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/310#pullrequestreview-591345040" title="Approved">JAORMX</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/310#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [hasheddan,saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->

Patch:
diff --git a/.gitignore b/.gitignore
index b74770193..6e159c045 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,4 +4,5 @@
 .vagrant
 Vagrantfile
 build
+image.tar
 result
diff --git a/Dockerfile b/Dockerfile
index 7d7df2877..cc93a3925 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -23,7 +23,7 @@ RUN wget https://nixos.org/releases/nix/nix-${NIX_VERSION}/nix-${NIX_VERSION}-$(
     groupadd -r -g 30000 nixbld && \
     for i in $(seq 1 30); do useradd -rM -u $((30000 + i)) -G nixbld nixbld$i ; done && \
     mkdir -m 0755 /etc/nix && \
-    echo 'sandbox = false' > /etc/nix/nix.conf && \
+    printf "sandbox = false\nfilter-syscalls = false\n" > /etc/nix/nix.conf && \
     mkdir -m 0755 /nix && \
     USER=root sh nix-${NIX_VERSION}-$(uname -m)-linux/install && \
     ln -s /nix/var/nix/profiles/default/etc/profile.d/nix.sh /etc/profile.d
diff --git a/Makefile b/Makefile
index 909747372..687eb6eb6 100644
--- a/Makefile
+++ b/Makefile
@@ -169,6 +169,15 @@ update-mocks: ## Update all generated mocks
 		mv tmp $$f ;\
 	done
 
+.PHONY: vagrant-up
+vagrant-up: ## Boot the vagrant based test VM
+	if [ ! -f image.tar ]; then \
+		make image IMAGE=$(IMAGE) && \
+		$(CONTAINER_RUNTIME) save -o image.tar $(IMAGE); \
+	fi
+	ln -sf hack/ci/Vagrantfile .
+	vagrant up
+
 # Verification targets
 
 .PHONY: verify
diff --git a/hack/ci/Vagrantfile b/hack/ci/Vagrantfile
index 572a0370d..7e4ac410c 100644
--- a/hack/ci/Vagrantfile
+++ b/hack/ci/Vagrantfile
@@ -33,6 +33,13 @@ Vagrant.configure("2") do |config|
     SHELL
   end
 
+  config.vm.provision "load-test-image", type: "shell", run: "once" do |sh|
+    sh.inline = <<~SHELL
+      set -euxo pipefail
+      sudo podman load -i /vagrant/image.tar
+    SHELL
+  end
+
   config.vm.provision "install-cri-o", type: "shell", run: "once" do |sh|
     sh.inline = <<~SHELL
       set -euxo pipefail


Test patch:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index c990d604b..6aa66ccd9 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -33,17 +33,31 @@ jobs:
           flags: unittests
           verbose: true
 
+  image:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - run: make image
+      - run: podman save -o image.tar security-profiles-operator
+      - uses: actions/upload-artifact@v2
+        with:
+          name: image
+          path: image.tar
+
   e2e:
+    needs: image
     runs-on: macos-10.15
     timeout-minutes: 40
     env:
       RUN: ./hack/ci/run.sh
     steps:
       - uses: actions/checkout@v2
+      - uses: actions/download-artifact@v2
+        with:
+          name: image
+          path: .
       - name: Boot Virtual Machine
-        run: |
-          ln -sf hack/ci/Vagrantfile .
-          vagrant up
+        run: make vagrant-up
       - name: Show environment information
         run: $RUN kubectl get nodes -o wide
       - name: Run E2E tests
diff --git a/test/suite_test.go b/test/suite_test.go
index 21bc5fdbe..991f78692 100644
--- a/test/suite_test.go
+++ b/test/suite_test.go
@@ -358,12 +358,7 @@ func (e *vanilla) SetupSuite() {
 }
 
 func (e *vanilla) SetupTest() {
-	// Build and load the test image
-	e.logf("Building operator container image")
-	e.run("make", "image", "IMAGE="+e.testImage)
-	e.run(
-		containerRuntime, "pull", e.selinuxdImage,
-	)
+	e.run(containerRuntime, "pull", e.selinuxdImage)
 }
 
 func (e *vanilla) TearDownTest() {