Repository: kubernetes-sigs/security-profiles-operator
Pull request #144 (2020-10-23 01:00:04)

Add Status field to SeccompProfile
Add a Status field to the SeccompProfile CRD. This attribute will
contain the path on disk to the profile as a helpful aid and source of
truth to cluster administrators for locating the profile.

<!--  Thanks for sending a pull request!  Here are some tips for you:

- If this is your first time, please read our contributor guidelines: https://git.k8s.io/community/contributors/guide#your-first-contribution and developer guide https://git.k8s.io/community/contributors/devel/development.md#development-guide
- Please label this pull request according to what type of issue you are addressing, especially if this is a release targeted pull request. For reference on required PR/issue labels, read here:
https://git.k8s.io/community/contributors/devel/sig-release/release.md#issuepr-kind-label
- If you want *faster* PR reviews, read how: https://git.k8s.io/community/contributors/guide/pull-requests.md#best-practices-for-faster-reviews
- If the PR is unfinished, see how to mark it: https://git.k8s.io/community/contributors/guide/pull-requests.md#marking-unfinished-pull-requests
-->

#### What type of PR is this?

<!--
Add one of the following kinds:
/kind bug
/kind cleanup
/kind documentation
/kind feature
/kind design

Optionally add one or more of the following kinds if applicable:
/kind api-change
/kind deprecation
/kind failing-test
/kind flake
/kind regression
-->

#### What this PR does / why we need it:

#### Which issue(s) this PR fixes:

<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.

Fixes #

or

None
-->

#### Special notes for your reviewer:

#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
Added Status field to SeccompProfile CRD to provide the path on disk to the profile.
```


k8s-ci-robot: @cmurphy: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our [release note process](https://git.k8s.io/community/contributors/guide/release-notes.md) to remove it.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
k8s-ci-robot: Hi @cmurphy. Thanks for your PR.

I'm waiting for a [kubernetes-sigs](https://github.com/orgs/kubernetes-sigs/people) member to verify that this patch is reasonable to test. If it is, they should reply with `/ok-to-test` on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should [join the org](https://git.k8s.io/community/community-membership.md#member) to skip this step.

Once the patch is verified, the new status will be reflected by the `ok-to-test` label.

I understand the commands that are listed [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>

k8s-ci-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/144#" title="Author self-approved">cmurphy</a>*
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please assign **saschagrunert** after the PR has been reviewed.
You can assign the PR to them by writing `/assign @saschagrunert` in a comment when ready.

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["saschagrunert"]} -->
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/144#" title="Author self-approved">cmurphy</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/144#pullrequestreview-515405192" title="Approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/144#" title="Author self-approved">cmurphy</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/144#pullrequestreview-515405409" title="LGTM">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->

Patch:
diff --git a/api/v1alpha1/seccompprofile_types.go b/api/v1alpha1/seccompprofile_types.go
index 157b94af0..30e0c43cf 100644
--- a/api/v1alpha1/seccompprofile_types.go
+++ b/api/v1alpha1/seccompprofile_types.go
@@ -83,16 +83,23 @@ type Arg struct {
 	Op seccomp.Operator `json:"op"`
 }
 
+// SeccompProfileStatus contains the host path of the deployed SeccompProfile.
+type SeccompProfileStatus struct {
+	Path string `json:"path,omitempty"`
+}
+
 // +kubebuilder:object:root=true
 
 // SeccompProfile is a cluster level specification for a seccomp profile.
 // See https://github.com/opencontainers/runtime-spec/blob/master/config-linux.md#seccomp
 // +kubebuilder:resource:shortName=sp
+// +kubebuilder:subresource:status
 type SeccompProfile struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
 
-	Spec SeccompProfileSpec `json:"spec,omitempty"`
+	Spec   SeccompProfileSpec   `json:"spec,omitempty"`
+	Status SeccompProfileStatus `json:"status,omitempty"`
 }
 
 // +kubebuilder:object:root=true
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
index 374dd6432..e093b887b 100644
--- a/api/v1alpha1/zz_generated.deepcopy.go
+++ b/api/v1alpha1/zz_generated.deepcopy.go
@@ -45,6 +45,7 @@ func (in *SeccompProfile) DeepCopyInto(out *SeccompProfile) {
 	out.TypeMeta = in.TypeMeta
 	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
 	in.Spec.DeepCopyInto(&out.Spec)
+	out.Status = in.Status
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SeccompProfile.
@@ -145,6 +146,21 @@ func (in *SeccompProfileSpec) DeepCopy() *SeccompProfileSpec {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SeccompProfileStatus) DeepCopyInto(out *SeccompProfileStatus) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SeccompProfileStatus.
+func (in *SeccompProfileStatus) DeepCopy() *SeccompProfileStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(SeccompProfileStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Syscall) DeepCopyInto(out *Syscall) {
 	*out = *in
diff --git a/deploy/base/crd.yaml b/deploy/base/crd.yaml
index 0ff437136..e09db0341 100644
--- a/deploy/base/crd.yaml
+++ b/deploy/base/crd.yaml
@@ -149,9 +149,17 @@ spec:
             required:
             - defaultAction
             type: object
+          status:
+            description: SeccompProfileStatus contains the host path of the deployed SeccompProfile.
+            properties:
+              path:
+                type: string
+            type: object
         type: object
     served: true
     storage: true
+    subresources:
+      status: {}
 status:
   acceptedNames:
     kind: ""
diff --git a/deploy/namespace-operator.yaml b/deploy/namespace-operator.yaml
index 7794c2271..3b961cc8f 100644
--- a/deploy/namespace-operator.yaml
+++ b/deploy/namespace-operator.yaml
@@ -342,9 +342,17 @@ spec:
             required:
             - defaultAction
             type: object
+          status:
+            description: SeccompProfileStatus contains the host path of the deployed SeccompProfile.
+            properties:
+              path:
+                type: string
+            type: object
         type: object
     served: true
     storage: true
+    subresources:
+      status: {}
 status:
   acceptedNames:
     kind: ""
diff --git a/deploy/operator.yaml b/deploy/operator.yaml
index bb0e9b59f..d794b4924 100644
--- a/deploy/operator.yaml
+++ b/deploy/operator.yaml
@@ -340,9 +340,17 @@ spec:
             required:
             - defaultAction
             type: object
+          status:
+            description: SeccompProfileStatus contains the host path of the deployed SeccompProfile.
+            properties:
+              path:
+                type: string
+            type: object
         type: object
     served: true
     storage: true
+    subresources:
+      status: {}
 status:
   acceptedNames:
     kind: ""
diff --git a/internal/pkg/controllers/profile/profile.go b/internal/pkg/controllers/profile/profile.go
index 821348463..2a22a52b0 100644
--- a/internal/pkg/controllers/profile/profile.go
+++ b/internal/pkg/controllers/profile/profile.go
@@ -157,14 +157,14 @@ func (r *Reconciler) Reconcile(req reconcile.Request) (reconcile.Result, error)
 	}
 
 	if seccompProfile != nil {
-		return r.reconcileSeccompProfile(seccompProfile, logger)
+		return r.reconcileSeccompProfile(ctx, seccompProfile, logger)
 	}
 
 	return r.reconcileConfigMap(configMap, logger)
 }
 
 func (r *Reconciler) reconcileSeccompProfile(
-	sp *seccompoperatorv1alpha1.SeccompProfile, l logr.Logger) (reconcile.Result, error) {
+	ctx context.Context, sp *seccompoperatorv1alpha1.SeccompProfile, l logr.Logger) (reconcile.Result, error) {
 	if sp == nil {
 		return reconcile.Result{}, errors.New(errSeccompProfileNil)
 	}
@@ -188,6 +188,11 @@ func (r *Reconciler) reconcileSeccompProfile(
 		r.record.Event(sp, event.Warning(reasonCannotSaveProfile, err))
 		return reconcile.Result{RequeueAfter: wait}, nil
 	}
+	sp.Status.Path = profilePath
+	if err = r.client.Status().Update(ctx, sp); err != nil {
+		l.Error(err, "cannot update SeccompProfile status")
+		return reconcile.Result{RequeueAfter: wait}, nil
+	}
 	l.Info(
 		"Reconciled profile from SeccompProfile",
 		"resource version", sp.GetResourceVersion(),


Test patch:
diff --git a/internal/pkg/controllers/profile/profile_test.go b/internal/pkg/controllers/profile/profile_test.go
index f90ecbb49..73b3cd761 100644
--- a/internal/pkg/controllers/profile/profile_test.go
+++ b/internal/pkg/controllers/profile/profile_test.go
@@ -146,7 +146,8 @@ func TestReconcile(t *testing.T) {
 		"CRDGotProfile": {
 			rec: &Reconciler{
 				client: &test.MockClient{
-					MockGet: test.NewMockGetFn(nil),
+					MockGet:          test.NewMockGetFn(nil),
+					MockStatusUpdate: test.NewMockStatusUpdateFn(nil),
 				},
 				log:    log.Log,
 				record: event.NewNopRecorder(),