Repository: kubernetes-sigs/security-profiles-operator
Pull request #1279 (2022-11-07 20:45:13)

doc: Document profile-in-use finalizer usage
This was confusing to some users. Let's document the finalizer usage.

<!--  Thanks for sending a pull request!  Here are some tips for you:

- If this is your first time, please read our contributor guidelines: https://git.k8s.io/community/contributors/guide#your-first-contribution and developer guide https://git.k8s.io/community/contributors/devel/development.md#development-guide
- Please label this pull request according to what type of issue you are addressing, especially if this is a release targeted pull request. For reference on required PR/issue labels, read here:
https://git.k8s.io/community/contributors/devel/sig-release/release.md#issuepr-kind-label
- If you want *faster* PR reviews, read how: https://git.k8s.io/community/contributors/guide/pull-requests.md#best-practices-for-faster-reviews
- If the PR is unfinished, see how to mark it: https://git.k8s.io/community/contributors/guide/pull-requests.md#marking-unfinished-pull-requests
-->

#### What type of PR is this?
/kind documentation

<!--
Add one of the following kinds:
/kind bug
/kind cleanup
/kind feature
/kind design

Optionally add one or more of the following kinds if applicable:
/kind api-change
/kind deprecation
/kind failing-test
/kind flake
/kind regression
-->

#### What this PR does / why we need it:
Just clarifies that we put finalizers on profiles in use.

#### Which issue(s) this PR fixes:
None

<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.

Fixes #

or

-->

#### Does this PR have test?
N/A

<!--
If tests aren't applicable just write N/A.
-->

#### Special notes for your reviewer:
N/A

#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
NONE
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1279#" title="Author self-approved">jhrozek</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [jhrozek]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->

Patch:
diff --git a/Makefile b/Makefile
index 5d354d19f..978fb1941 100644
--- a/Makefile
+++ b/Makefile
@@ -16,7 +16,7 @@ GO ?= go
 
 GOLANGCI_LINT_VERSION = v1.50.1
 REPO_INFRA_VERSION = v0.2.5
-KUSTOMIZE_VERSION = 4.5.5
+KUSTOMIZE_VERSION = 4.5.7
 OPERATOR_SDK_VERSION ?= v1.25.0
 
 CONTROLLER_GEN_CMD := CGO_LDFLAGS= $(GO) run -tags generate sigs.k8s.io/controller-tools/cmd/controller-gen
diff --git a/dependencies.yaml b/dependencies.yaml
index 043191560..94b90e88f 100644
--- a/dependencies.yaml
+++ b/dependencies.yaml
@@ -28,7 +28,7 @@ dependencies:
       match: REPO_INFRA_VERSION
 
   - name: kustomize
-    version: 4.5.5
+    version: 4.5.7
     refPaths:
     - path: Makefile
       match: KUSTOMIZE_VERSION
@@ -56,13 +56,13 @@ dependencies:
       match: cert-manager/cert-manager
 
   - name: kind
-    version: 0.15.0
+    version: 0.17.0
     refPaths:
     - path: test/suite_test.go
       match: kindVersion
 
   - name: kind-image
-    version: 1.25.0
+    version: 1.25.3
     refPaths:
     - path: test/suite_test.go
       match: kindImage
@@ -76,7 +76,7 @@ dependencies:
       match: QEMUVERSION
 
   - name: e2e-kubernetes
-    version: 1.25.0
+    version: 1.25.3
     refPaths:
     - path: hack/ci/install-kubernetes.sh
       match: VERSION
diff --git a/hack/ci/Vagrantfile-ubuntu b/hack/ci/Vagrantfile-ubuntu
index b3c2158d8..6275cec3b 100644
--- a/hack/ci/Vagrantfile-ubuntu
+++ b/hack/ci/Vagrantfile-ubuntu
@@ -33,7 +33,7 @@ Vagrant.configure("2") do |config|
       curl -sSfL https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add -
       echo "deb http://apt.kubernetes.io/ kubernetes-xenial main" > /etc/apt/sources.list.d/kubernetes.list
       apt-get update
-      KUBERNETES_VERSION=1.25.0-00
+      KUBERNETES_VERSION=1.25.3-00
       apt-get install -y \
         build-essential \
         kubelet=$KUBERNETES_VERSION \
diff --git a/hack/ci/install-kubernetes.sh b/hack/ci/install-kubernetes.sh
index 1c44f0b5c..330a21e15 100755
--- a/hack/ci/install-kubernetes.sh
+++ b/hack/ci/install-kubernetes.sh
@@ -19,7 +19,7 @@ ENVFILE=$(dirname "${BASH_SOURCE[0]}")/env-fedora.sh
 . "$ENVFILE"
 
 K8SPATH="$GOPATH/src/k8s.io"
-VERSION=v1.25.0
+VERSION=v1.25.3
 
 download-kubernetes() {
     export KUBERNETES_RELEASE=$VERSION
diff --git a/installation-usage.md b/installation-usage.md
index d6e920536..ffdd3f5ae 100644
--- a/installation-usage.md
+++ b/installation-usage.md
@@ -345,6 +345,10 @@ $ kubectl --namespace my-namespace get deployment myapp --output=jsonpath='{.spe
 }
 ```
 
+Note that a security profile that is in use by existing pods cannot be
+deleted unless the pods exit or are removed - the profile deletion is
+protected by finalizers.
+
 ### Base syscalls for a container runtime
 
 An example of the minimum required syscalls for a runtime such as


Test patch:
diff --git a/.github/workflows/olm_tests.yaml b/.github/workflows/olm_tests.yaml
index a140e8f41..19d47b108 100644
--- a/.github/workflows/olm_tests.yaml
+++ b/.github/workflows/olm_tests.yaml
@@ -6,7 +6,7 @@ on:
   pull_request:
 env:
   GO_VERSION: '1.19'
-  KIND_IMG_TAG: v1.25.0
+  KIND_IMG_TAG: v1.25.3
 permissions:
   actions: none
   checks: none
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 19be548b1..3f7c0c82a 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -29,11 +29,11 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v3
-      - uses: github/codeql-action/init@18fe527fa8b29f134bb91f32f1a5dc5abb15ed7f
+      - uses: github/codeql-action/init@c3b6fce4ee2ca25bc1066aa3bf73962fda0e8898
         with:
           languages: go
-      - uses: github/codeql-action/autobuild@18fe527fa8b29f134bb91f32f1a5dc5abb15ed7f
-      - uses: github/codeql-action/analyze@18fe527fa8b29f134bb91f32f1a5dc5abb15ed7f
+      - uses: github/codeql-action/autobuild@c3b6fce4ee2ca25bc1066aa3bf73962fda0e8898
+      - uses: github/codeql-action/analyze@c3b6fce4ee2ca25bc1066aa3bf73962fda0e8898
 
   coverage:
     runs-on: ubuntu-22.04
diff --git a/test/suite_test.go b/test/suite_test.go
index 51fb0f2a2..bb50256f3 100644
--- a/test/suite_test.go
+++ b/test/suite_test.go
@@ -39,10 +39,10 @@ import (
 )
 
 const (
-	kindVersion      = "v0.15.0"
-	kindImage        = "kindest/node:v1.25.0@sha256:428aaa17ec82ccde0131cb2d1ca6547d13cf5fdabcc0bbecf749baa935387cbf"
-	kindDarwinSHA512 = "f9b4e1ef345d831c19014cce1db42949ff68452590759b4802d183063e5280dfb1c92fd9626d9c952c60d9e440e9872c97525bd9a3b4ba53e43c00762d1e9980" //nolint:lll // full length SHA
-	kindLinuxSHA512  = "9c397eb7cc64f7fb0ac8d686ebf3836aaf485a1a480baa23b91a5167aa1d30b16a730de32910f9463d2028e01d56412bbfb3e9afdaa94b7eb19eef21c650e973" //nolint:lll // full length SHA
+	kindVersion      = "v0.17.0"
+	kindImage        = "kindest/node:v1.25.3@sha256:f52781bc0d7a19fb6c405c2af83abfeb311f130707a0e219175677e366cc45d1"
+	kindDarwinSHA512 = "40ebb37b74b88d71854f73bc8d505e5cfb7ad14952657f0f9f46605632f2611277d09e8b00d05e95d10f913bd31d816131a3e26e7f34a6f2e50297d146f15050" //nolint:lll // full length SHA
+	kindLinuxSHA512  = "ae9b8ad431157c47bd034552e6b1656e46aa4033e96f25d5ff5d539308f17b2b003d25e02656f461d3eeed4e3ba0507b8523f6fa9180b59f37a5f083f62e5560" //nolint:lll // full length SHA
 )
 
 var (