Repository: kubernetes-sigs/security-profiles-operator
Pull request #293 (2021-02-11 09:13:23)

e2e: Use fedora-based selinuxd image for e2e tests
#### What type of PR is this?

/kind bug

#### What this PR does / why we need it:

The default image is CentOS-based, which works in CentOS, RHEL and
RHCOS. But our e2e tests use Fedora, which doesn't recognize the
libsemanage configuration format (and most likely the policy format
too). So, let's switch to a fedora-based image for this test

#### Which issue(s) this PR fixes:

None

#### Does this PR have test?

N/A.

#### Does this PR introduce a user-facing change?

```release-note
NONE
```

k8s-ci-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/293#" title="Author self-approved">JAORMX</a>*
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please assign **saschagrunert** after the PR has been reviewed.
You can assign the PR to them by writing `/assign @saschagrunert` in a comment when ready.

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["saschagrunert"]} -->
codecov-io: # [Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/293?src=pr&el=h1) Report
> Merging [#293](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/293?src=pr&el=desc) (485c9e7) into [master](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/commit/df77c61f0fc4a88ff4e8d5a7947882bd77c8d265?el=desc) (df77c61) will **not change** coverage.
> The diff coverage is `n/a`.

[![Impacted file tree graph](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/293/graphs/tree.svg?width=650&height=150&src=pr&token=37VIWSZ1ZT)](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/293?src=pr&el=tree)

```diff
@@           Coverage Diff           @@
##           master     #293   +/-   ##
=======================================
  Coverage   25.48%   25.48%           
=======================================
  Files           8        8           
  Lines         616      616           
=======================================
  Hits          157      157           
  Misses        441      441           
  Partials       18       18           
```

| Flag | Coverage Δ | |
|---|---|---|
| unittests | `25.48% <ø> (ø)` | |

Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags#carryforward-flags-in-the-pull-request-comment) to find out more.


------

[Continue to review full report at Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/293?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/293?src=pr&el=footer). Last update [df77c61...485c9e7](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/293?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).


Patch:
diff --git a/hack/ci/install-cri-o.sh b/hack/ci/install-cri-o.sh
index 994dbce26..9a3033b10 100755
--- a/hack/ci/install-cri-o.sh
+++ b/hack/ci/install-cri-o.sh
@@ -47,12 +47,25 @@ chcon -R -u system_u -r object_r -t var_lib_t /var/lib/kubelet
 
 mkdir -p /etc/crio/crio.conf.d
 
+cat <<EOT >>/etc/crio/crio.conf.d/30-selinux.conf
+[crio.runtime]
+selinux = true
+EOT
+
 cat <<EOT >>/etc/crio/crio.conf.d/30-cgroup-manager.conf
 [crio.runtime]
 conmon_cgroup = "pod"
 cgroup_manager = "cgroupfs"
 EOT
 
+cat <<EOT >>/etc/crio/crio.conf.d/20-crun.conf
+[crio.runtime]
+default_runtime = "crun"
+
+[crio.runtime.runtimes.crun]
+runtime_path = "/usr/local/bin/crun"
+EOT
+
 chcon -R -u system_u -r object_r -t container_config_t \
     /etc/crio \
     /etc/crio/crio.conf \


Test patch:
diff --git a/hack/ci/e2e.sh b/hack/ci/e2e.sh
index 8ce716036..1a705c039 100755
--- a/hack/ci/e2e.sh
+++ b/hack/ci/e2e.sh
@@ -16,7 +16,7 @@
 set -euo pipefail
 
 export E2E_CLUSTER_TYPE=vanilla
-#export E2E_TEST_SELINUX=true
+export E2E_TEST_SELINUX=true
 
 # These are already tested in the standard e2e test.
 # No need to test them here.
diff --git a/test/e2e_test.go b/test/e2e_test.go
index cd2b297f3..89f20fdb8 100644
--- a/test/e2e_test.go
+++ b/test/e2e_test.go
@@ -144,6 +144,10 @@ func (e *e2e) deployOperator(manifest string) {
 		"sed", "-i", fmt.Sprintf("s;value: .*gcr.io/.*;value: %s;g", e.testImage),
 		manifest,
 	)
+	e.run(
+		"sed", "-i", fmt.Sprintf("s;value: .*quay.io/.*/selinuxd.*;value: %s;g", e.selinuxdImage),
+		manifest,
+	)
 
 	if e.selinuxEnabled {
 		e.run(
diff --git a/test/suite_test.go b/test/suite_test.go
index e813dab7d..1c42f7e74 100644
--- a/test/suite_test.go
+++ b/test/suite_test.go
@@ -57,6 +57,7 @@ type e2e struct {
 	suite.Suite
 	kubectlPath        string
 	testImage          string
+	selinuxdImage      string
 	pullPolicy         string
 	selinuxEnabled     bool
 	testSeccomp        bool
@@ -102,6 +103,7 @@ func TestSuite(t *testing.T) {
 	if err != nil {
 		testProfileBinding = true
 	}
+	selinuxdImage := "quay.io/jaosorior/selinuxd"
 	switch {
 	case clusterType == "" || strings.EqualFold(clusterType, "kind"):
 		if testImage == "" {
@@ -115,6 +117,7 @@ func TestSuite(t *testing.T) {
 				selinuxEnabled:     selinuxEnabled,
 				testSeccomp:        testSeccomp,
 				testProfileBinding: testProfileBinding,
+				selinuxdImage:      selinuxdImage,
 			},
 			"", "",
 		})
@@ -137,6 +140,7 @@ func TestSuite(t *testing.T) {
 				selinuxEnabled:     selinuxEnabled,
 				testSeccomp:        testSeccomp,
 				testProfileBinding: testProfileBinding,
+				selinuxdImage:      selinuxdImage,
 			},
 			skipBuildImages,
 			skipPushImages,
@@ -145,6 +149,7 @@ func TestSuite(t *testing.T) {
 		if testImage == "" {
 			testImage = "localhost/" + config.OperatorName + ":latest"
 		}
+		selinuxdImage = "quay.io/jaosorior/selinuxd-fedora"
 		suite.Run(t, &vanilla{
 			e2e{
 				logger:             klogr.New(),
@@ -153,6 +158,7 @@ func TestSuite(t *testing.T) {
 				selinuxEnabled:     selinuxEnabled,
 				testSeccomp:        testSeccomp,
 				testProfileBinding: testProfileBinding,
+				selinuxdImage:      selinuxdImage,
 			},
 		})
 	default:
@@ -219,7 +225,7 @@ func (e *kinde2e) SetupTest() {
 		e.kindPath, "load", "docker-image", "--name="+e.clusterName, e.testImage,
 	)
 	e.run(
-		"docker", "pull", "quay.io/jaosorior/selinuxd",
+		containerRuntime, "pull", e.selinuxdImage,
 	)
 	e.run(
 		e.kindPath, "load", "docker-image", "--name="+e.clusterName, "quay.io/jaosorior/selinuxd",
@@ -350,7 +356,7 @@ func (e *vanilla) SetupTest() {
 	e.logf("Building operator container image")
 	e.run("make", "image", "IMAGE="+e.testImage)
 	e.run(
-		containerRuntime, "pull", "quay.io/jaosorior/selinuxd",
+		containerRuntime, "pull", e.selinuxdImage,
 	)
 }
 
diff --git a/test/tc_selinux_sanity_check_test.go b/test/tc_selinux_sanity_check_test.go
index a04c3859c..b6e1ac937 100644
--- a/test/tc_selinux_sanity_check_test.go
+++ b/test/tc_selinux_sanity_check_test.go
@@ -53,7 +53,7 @@ spec:
 	e.logf("the workload should have errored")
 	expectedLog := "/bin/bash: /var/log/test.log: Permission denied"
 	log := e.kubectl("logs", "el-no-policy", "-c", "errorlogger")
-	e.Equalf(log, expectedLog, "container should have returned a 'Permissions Denied' error")
+	e.Equalf(expectedLog, log, "container should have returned a 'Permissions Denied' error")
 
 	e.kubectl("delete", "pod", "el-no-policy")
 }