Repository: kubernetes-sigs/security-profiles-operator
Pull request #295 (2021-02-11 12:57:50)

Remove clusterRole and clusterRoleBinding overrides from namespaced-operator
#### What type of PR is this?

/kind cleanup

#### What this PR does / why we need it:

The main target of this type of deployment is to have the SPO to only
liten for policies in specific namespaces. Having these overrides only
adds extra complexity, and the operator itself is able to function
without these.

Let's remove this extra complexity!

#### Which issue(s) this PR fixes:

None

#### Does this PR have test?

This is already covered by the namespace set of tests

#### Special notes for your reviewer:

#### Does this PR introduce a user-facing change?

```release-note
The namespaced-operator deployment now relies on a ClusterRole and a ClusterRoleBinding instead of the previous Role And RoleBinding objects. It now more closely resembles the cluster-operator deployment.
```

k8s-ci-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/295#" title="Author self-approved">JAORMX</a>*
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please assign **hasheddan** after the PR has been reviewed.
You can assign the PR to them by writing `/assign @hasheddan` in a comment when ready.

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["hasheddan"]} -->
codecov-io: # [Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/295?src=pr&el=h1) Report
> Merging [#295](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/295?src=pr&el=desc) (329d78f) into [master](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/commit/2fce3843fadbc7f1aa17ab5d9ef6e6dcf3e64c4a?el=desc) (2fce384) will **not change** coverage.
> The diff coverage is `n/a`.

[![Impacted file tree graph](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/295/graphs/tree.svg?width=650&height=150&src=pr&token=37VIWSZ1ZT)](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/295?src=pr&el=tree)

```diff
@@           Coverage Diff           @@
##           master     #295   +/-   ##
=======================================
  Coverage   25.48%   25.48%           
=======================================
  Files           8        8           
  Lines         616      616           
=======================================
  Hits          157      157           
  Misses        441      441           
  Partials       18       18           
```

| Flag | Coverage Δ | |
|---|---|---|
| unittests | `25.48% <ø> (ø)` | |

Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags#carryforward-flags-in-the-pull-request-comment) to find out more.


------

[Continue to review full report at Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/295?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/295?src=pr&el=footer). Last update [2fce384...329d78f](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/295?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).


Patch:
diff --git a/.gitignore b/.gitignore
index d8073b22c..b74770193 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,4 @@
 .vagrant
 Vagrantfile
 build
+result
diff --git a/Makefile b/Makefile
index fa1ecf957..eb222c5fc 100644
--- a/Makefile
+++ b/Makefile
@@ -40,6 +40,7 @@ else
 LINT_BUILDTAGS := e2e,netgo,osusergo,-tools
 endif
 
+export CGO_ENABLED=1
 
 BUILD_FILES := $(shell find . -type f -name '*.go' -or -name '*.mod' -or -name '*.sum' -not -name '*_test.go')
 export GOFLAGS?=-mod=vendor
@@ -56,7 +57,7 @@ else
   LDFLAGS := -s -w -extldflags "-static" $(LDVARS)
 endif
 
-export CONTAINER_RUNTIME ?= $(if $(shell which podman),podman,docker)
+export CONTAINER_RUNTIME ?= $(if $(shell which podman 2>/dev/null),podman,docker)
 
 ifeq ($(CONTAINER_RUNTIME), podman)
     LOGIN_PUSH_OPTS="--tls-verify=false"
@@ -126,6 +127,19 @@ deployments: manifests ## Generate the deployment files with kustomize
 image: ## Build the container image
 	$(CONTAINER_RUNTIME) build -f $(DOCKERFILE) --build-arg version=$(VERSION) -t $(IMAGE) .
 
+.PHONY: nix
+nix: ## Build the binary via nix for the current system
+	nix-build nix
+
+.PHONY: nix-arm64
+nix-arm64: ## Build the binary via nix for arm64
+	nix-build nix/default-arm64.nix
+
+.PHONY: update-nixpkgs
+update-nixpkgs: ## Update the pinned nixpkgs to the latest master
+	@nix run -f channel:nixpkgs-unstable nix-prefetch-git -c nix-prefetch-git \
+		--no-deepClone https://github.com/nixos/nixpkgs > nix/nixpkgs.json
+
 # Verification targets
 
 .PHONY: verify
diff --git a/deploy/namespace-operator.yaml b/deploy/namespace-operator.yaml
index dc167050b..51608d614 100644
--- a/deploy/namespace-operator.yaml
+++ b/deploy/namespace-operator.yaml
@@ -310,12 +310,12 @@ metadata:
   namespace: security-profiles-operator
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
+kind: ClusterRole
 metadata:
   labels:
     app: security-profiles-operator
   name: config-map-reader
-  namespace: NS_REPLACE
+  namespace: security-profiles-operator
 rules:
 - apiGroups:
   - ""
@@ -372,15 +372,14 @@ rules:
   - patch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
+kind: ClusterRoleBinding
 metadata:
   labels:
     app: security-profiles-operator
   name: config-map-reader-binding
-  namespace: NS_REPLACE
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: Role
+  kind: ClusterRole
   name: config-map-reader
 subjects:
 - kind: ServiceAccount
diff --git a/deploy/overlays/namespaced/clusterrole.yaml b/deploy/overlays/namespaced/clusterrole.yaml
deleted file mode 100644
index 010d3b6cd..000000000
--- a/deploy/overlays/namespaced/clusterrole.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-- op: replace
-  path: /kind
-  value: Role
-- op: replace
-  path: /metadata/namespace
-  value: NS_REPLACE
diff --git a/deploy/overlays/namespaced/clusterrolebinding.yaml b/deploy/overlays/namespaced/clusterrolebinding.yaml
deleted file mode 100644
index a1e392e3e..000000000
--- a/deploy/overlays/namespaced/clusterrolebinding.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
-- op: replace
-  path: /kind
-  value: RoleBinding
-- op: replace
-  path: /metadata/namespace
-  value: NS_REPLACE
-- op: replace
-  path: /roleRef/kind
-  value: Role
diff --git a/deploy/overlays/namespaced/kustomization.yaml b/deploy/overlays/namespaced/kustomization.yaml
index 343d74165..87ae241f8 100644
--- a/deploy/overlays/namespaced/kustomization.yaml
+++ b/deploy/overlays/namespaced/kustomization.yaml
@@ -7,19 +7,4 @@ bases:
   - ../cluster
 
 patchesStrategicMerge:
-  - deployment.yaml
-
-patchesJson6902:
-  - target:
-      group: rbac.authorization.k8s.io
-      version: v1
-      kind: ClusterRole
-      name: config-map-reader
-    path: clusterrole.yaml
-
-  - target:
-      group: rbac.authorization.k8s.io
-      version: v1
-      kind: ClusterRoleBinding
-      name: config-map-reader-binding
-    path: clusterrolebinding.yaml
+  - deployment.yaml
\ No newline at end of file
diff --git a/hack/ci/install-cri-o.sh b/hack/ci/install-cri-o.sh
index 9a3033b10..087f0b632 100755
--- a/hack/ci/install-cri-o.sh
+++ b/hack/ci/install-cri-o.sh
@@ -29,6 +29,13 @@ mv crio-* crio
 
 make -C crio
 
+# Use the latest crun release
+CRUN=0.17
+curl -sfL --retry 5 --retry-delay 3 --show-error \
+    https://github.com/containers/crun/releases/download/$CRUN/crun-$CRUN-linux-amd64 \
+    -o /usr/local/bin/crun
+chmod +x /usr/local/bin/crun
+
 chcon -u system_u -r object_r -t container_runtime_exec_t \
     /usr/local/bin/crio \
     /usr/local/bin/crio-status \
diff --git a/nix/default-arm64.nix b/nix/default-arm64.nix
new file mode 100644
index 000000000..edb5c734c
--- /dev/null
+++ b/nix/default-arm64.nix
@@ -0,0 +1,6 @@
+(import ./nixpkgs.nix {
+  crossSystem = {
+    config = "aarch64-unknown-linux-gnu";
+  };
+}).callPackage ./derivation.nix
+{ }
diff --git a/nix/default.nix b/nix/default.nix
new file mode 100644
index 000000000..3bf7c70fa
--- /dev/null
+++ b/nix/default.nix
@@ -0,0 +1,1 @@
+(import ./nixpkgs.nix { }).callPackage ./derivation.nix { }
diff --git a/nix/derivation.nix b/nix/derivation.nix
new file mode 100644
index 000000000..de9bd6883
--- /dev/null
+++ b/nix/derivation.nix
@@ -0,0 +1,24 @@
+{ pkgs, buildGoModule }:
+with pkgs; buildGoModule rec {
+  name = "security-profiles-operator";
+  src = ./..;
+  vendorSha256 = null;
+  doCheck = false;
+  outputs = [ "out" ];
+  nativeBuildInputs = with buildPackages; [
+    git
+    pkg-config
+    which
+  ];
+  buildInputs = [
+    glibc
+    glibc.static
+    (libseccomp.overrideAttrs (x: { dontDisableStatic = true; }))
+  ];
+  buildPhase = ''
+    make
+  '';
+  installPhase = ''
+    install -Dm755 -t $out build/security-profiles-operator
+  '';
+}
diff --git a/nix/nixpkgs.json b/nix/nixpkgs.json
new file mode 100644
index 000000000..84a2c1a31
--- /dev/null
+++ b/nix/nixpkgs.json
@@ -0,0 +1,10 @@
+{
+  "url": "https://github.com/nixos/nixpkgs",
+  "rev": "cc0da25d94f300f9098d3c8bae2106c7997805e4",
+  "date": "2021-02-10T15:00:01+01:00",
+  "path": "/nix/store/f7xw50gii6j3f88lfb7s7crzs6sdxwxi-nixpkgs",
+  "sha256": "0xarfhl988s5npnaqjgw6291pqcpa0pswaqfp05k8gvzrixs52q0",
+  "fetchSubmodules": false,
+  "deepClone": false,
+  "leaveDotGit": false
+}
diff --git a/nix/nixpkgs.nix b/nix/nixpkgs.nix
new file mode 100644
index 000000000..21e7f17a2
--- /dev/null
+++ b/nix/nixpkgs.nix
@@ -0,0 +1,8 @@
+let
+  json = builtins.fromJSON (builtins.readFile ./nixpkgs.json);
+  nixpkgs = import (builtins.fetchTarball {
+    name = "nixos-unstable";
+    url = "${json.url}/archive/${json.rev}.tar.gz";
+    inherit (json) sha256;
+  });
+in nixpkgs


Test patch:
diff --git a/test/suite_test.go b/test/suite_test.go
index 1c42f7e74..21bc5fdbe 100644
--- a/test/suite_test.go
+++ b/test/suite_test.go
@@ -53,6 +53,12 @@ var (
 	containerRuntime              = os.Getenv("CONTAINER_RUNTIME")
 )
 
+const (
+	clusterTypeKind      = "kind"
+	clusterTypeVanilla   = "vanilla"
+	clusterTypeOpenShift = "openshift"
+)
+
 type e2e struct {
 	suite.Suite
 	kubectlPath        string
@@ -105,7 +111,7 @@ func TestSuite(t *testing.T) {
 	}
 	selinuxdImage := "quay.io/jaosorior/selinuxd"
 	switch {
-	case clusterType == "" || strings.EqualFold(clusterType, "kind"):
+	case clusterType == "" || strings.EqualFold(clusterType, clusterTypeKind):
 		if testImage == "" {
 			testImage = config.OperatorName + ":latest"
 		}
@@ -121,7 +127,7 @@ func TestSuite(t *testing.T) {
 			},
 			"", "",
 		})
-	case strings.EqualFold(clusterType, "openshift"):
+	case strings.EqualFold(clusterType, clusterTypeOpenShift):
 		skipBuildImages, err := strconv.ParseBool(envSkipBuildImages)
 		if err != nil {
 			skipBuildImages = false
@@ -145,7 +151,7 @@ func TestSuite(t *testing.T) {
 			skipBuildImages,
 			skipPushImages,
 		})
-	case strings.EqualFold(clusterType, "vanilla"):
+	case strings.EqualFold(clusterType, clusterTypeVanilla):
 		if testImage == "" {
 			testImage = "localhost/" + config.OperatorName + ":latest"
 		}
diff --git a/test/tc_base_profiles_test.go b/test/tc_base_profiles_test.go
index f1019987d..cdec2840a 100644
--- a/test/tc_base_profiles_test.go
+++ b/test/tc_base_profiles_test.go
@@ -24,9 +24,15 @@ import (
 )
 
 func (e *e2e) testCaseBaseProfile([]string) {
-	e.seccompOnlyTestCase()
-	const baseProfilePath = "examples/baseprofile-runc.yaml"
-	const helloProfile = `
+	baseProfilePath := "examples/baseprofile-runc.yaml"
+	baseProfileName := "runc-v1.0.0-rc92"
+
+	if clusterType == clusterTypeVanilla {
+		baseProfilePath = "examples/baseprofile-crun.yaml"
+		baseProfileName = "crun-v0.17"
+	}
+
+	helloProfile := fmt.Sprintf(`
 apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
 kind: SeccompProfile
 metadata:
@@ -34,14 +40,15 @@ metadata:
 spec:
   defaultAction: SCMP_ACT_ERRNO
   targetWorkload: hello
-  baseProfileName: runc-v1.0.0-rc92
+  baseProfileName: %s
   syscalls:
   - action: SCMP_ACT_ALLOW
     names:
     - arch_prctl
     - set_tid_address
     - exit_group
-`
+`, baseProfileName)
+
 	const helloPod = `
 apiVersion: v1
 kind: Pod