Repository: kubernetes-sigs/security-profiles-operator
Pull request #265 (2021-02-03 12:23:38)

Reuse deployment image to daemon set
#### What type of PR is this?

/kind feature

#### What this PR does / why we need it:
We can retrieve the currently running image with the help of an
additional client get request. This allows us to get rid of an
additional environment variable for the daemonset container image.
#### Which issue(s) this PR fixes:

<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.

Fixes #

or

None
-->
None
#### Does this PR have test?
None
<!--
If tests aren't applicable just write N/A.
-->

#### Special notes for your reviewer:
None
#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
None
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/265#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/265#pullrequestreview-582316735" title="LGTM">pjbgf</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/265#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [pjbgf,saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
k8s-ci-robot: @saschagrunert: PR needs rebase.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
k8s-ci-robot: New changes are detected. LGTM label has been removed.
saschagrunert: Had to rebase on top of the latest master.
JAORMX: /lgtm

Patch:
diff --git a/Makefile b/Makefile
index 5ae51de47..f2640bbbb 100644
--- a/Makefile
+++ b/Makefile
@@ -176,7 +176,7 @@ test-unit: $(BUILD_DIR) ## Run the unit tests
 
 .PHONY: test-e2e
 test-e2e: ## Run the end-to-end tests
-	$(GO) test -race -timeout 40m -count=1 ./test/... -v
+	$(GO) test -parallel 1 -timeout 40m -count=1 ./test/... -v
 
 # Generate CRD manifests
 manifests: $(CONTROLLER_GEN)
diff --git a/cmd/security-profiles-operator/main.go b/cmd/security-profiles-operator/main.go
index 38160773b..19e6c6914 100644
--- a/cmd/security-profiles-operator/main.go
+++ b/cmd/security-profiles-operator/main.go
@@ -49,7 +49,6 @@ import (
 const (
 	jsonFlag               string = "json"
 	selinuxFlag            string = "with-selinux"
-	operatorImageKey       string = "RELATED_IMAGE_OPERATOR"
 	nonRootEnablerImageKey string = "RELATED_IMAGE_NON_ROOT_ENABLER"
 	selinuxdImageKey       string = "RELATED_IMAGE_SELINUXD"
 	defaultWebhookPort     int    = 9443
@@ -211,12 +210,6 @@ func runManager(ctx *cli.Context) error {
 func getTunables() (dt spod.DaemonTunables, err error) {
 	dt.WatchNamespace = os.Getenv(config.RestrictNamespaceEnvKey)
 
-	operatorImage := os.Getenv(operatorImageKey)
-	if operatorImage == "" {
-		return dt, errors.New("invalid operator image")
-	}
-	dt.DaemonImage = operatorImage
-
 	nonRootEnableImage := os.Getenv(nonRootEnablerImageKey)
 	if nonRootEnableImage == "" {
 		return dt, errors.New("invalid non-root enabler image")
diff --git a/deploy/base/kustomization.yaml b/deploy/base/kustomization.yaml
index 9bc67205c..c1a90b4e2 100644
--- a/deploy/base/kustomization.yaml
+++ b/deploy/base/kustomization.yaml
@@ -23,8 +23,6 @@ patchesStrategicMerge:
         containers:
           - name: security-profiles-operator
             env:
-              - name: RELATED_IMAGE_OPERATOR
-                value: gcr.io/k8s-staging-sp-operator/security-profiles-operator:latest
               - name: RELATED_IMAGE_NON_ROOT_ENABLER
                 value: bash:5.0
               - name: RELATED_IMAGE_SELINUXD
diff --git a/deploy/base/operator.yaml b/deploy/base/operator.yaml
index feca48bc2..16d11fb72 100644
--- a/deploy/base/operator.yaml
+++ b/deploy/base/operator.yaml
@@ -27,8 +27,6 @@ spec:
             readOnlyRootFilesystem: true
             allowPrivilegeEscalation: false
           env:
-            - name: RELATED_IMAGE_OPERATOR
-              value: security-profiles-operator
             - name: RELATED_IMAGE_NON_ROOT_ENABLER
               value: non-root-enabler
             - name: RELATED_IMAGE_SELINUXD
diff --git a/deploy/namespace-operator.yaml b/deploy/namespace-operator.yaml
index 32d0c314f..adb59e7e2 100644
--- a/deploy/namespace-operator.yaml
+++ b/deploy/namespace-operator.yaml
@@ -502,8 +502,6 @@ spec:
         env:
         - name: RESTRICT_TO_NAMESPACE
           value: NS_REPLACE
-        - name: RELATED_IMAGE_OPERATOR
-          value: gcr.io/k8s-staging-sp-operator/security-profiles-operator:latest
         - name: RELATED_IMAGE_NON_ROOT_ENABLER
           value: bash:5.0
         - name: RELATED_IMAGE_SELINUXD
diff --git a/deploy/operator.yaml b/deploy/operator.yaml
index aa33c9697..f168c8683 100644
--- a/deploy/operator.yaml
+++ b/deploy/operator.yaml
@@ -499,8 +499,6 @@ spec:
       - args:
         - manager
         env:
-        - name: RELATED_IMAGE_OPERATOR
-          value: gcr.io/k8s-staging-sp-operator/security-profiles-operator:latest
         - name: RELATED_IMAGE_NON_ROOT_ENABLER
           value: bash:5.0
         - name: RELATED_IMAGE_SELINUXD
diff --git a/deploy/overlays/openshift-dev/kustomization.yaml b/deploy/overlays/openshift-dev/kustomization.yaml
index dfbaa0e77..7e8c52461 100644
--- a/deploy/overlays/openshift-dev/kustomization.yaml
+++ b/deploy/overlays/openshift-dev/kustomization.yaml
@@ -22,19 +22,3 @@ images:
   - name: gcr.io/k8s-staging-sp-operator/security-profiles-operator
     newName: image-registry.openshift-image-registry.svc:5000/openshift/security-profiles-operator
     newTag: latest
-
-patchesStrategicMerge:
-- |-
-  apiVersion: apps/v1
-  kind: Deployment
-  metadata:
-    name: security-profiles-operator
-    namespace: security-profiles-operator
-  spec:
-    template:
-      spec:
-        containers:
-          - name: security-profiles-operator
-            env:
-              - name: RELATED_IMAGE_OPERATOR
-                value: image-registry.openshift-image-registry.svc:5000/openshift/security-profiles-operator:latest
\ No newline at end of file
diff --git a/examples/pod.yaml b/examples/pod.yaml
index 303aa07c8..dca54741e 100644
--- a/examples/pod.yaml
+++ b/examples/pod.yaml
@@ -8,7 +8,7 @@ metadata:
     # Or one example within this directory
     # Please note the syntax:
     # `localhost/operator/{namespace}/{configmap-name}/{profile-name}`
-    # seccomp.security.alpha.kubernetes.io/pod: 'localhost/operator/default/example-profiles/profile-allow.json'
+    # seccomp.security.alpha.kubernetes.io/pod: 'localhost/operator/default/generic/profile-allow-unsafe.json'
 spec:
   containers:
   - name: test-container
diff --git a/examples/profilebinding.yaml b/examples/profilebinding.yaml
index ac3cab91d..6b19ce2d3 100644
--- a/examples/profilebinding.yaml
+++ b/examples/profilebinding.yaml
@@ -6,5 +6,5 @@ metadata:
 spec:
   profileRef:
     kind: SeccompProfile
-    name: profile-allow
+    name: profile-allow-unsafe
   image: nginx:1.19.1
diff --git a/examples/seccompprofile.yaml b/examples/seccompprofile.yaml
index fe1d54a82..a0b583477 100644
--- a/examples/seccompprofile.yaml
+++ b/examples/seccompprofile.yaml
@@ -2,23 +2,101 @@
 apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
 kind: SeccompProfile
 metadata:
-  name: profile-block
+  name: profile-block-all
+  annotations:
+    description: "Blocks all syscalls."
 spec:
   defaultAction: "SCMP_ACT_ERRNO"
-  targetWorkload: "example-profiles"
+  targetWorkload: "generic"
 ---
 apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
 kind: SeccompProfile
 metadata:
-  name: profile-complain
+  name: profile-complain-unsafe
+  annotations:
+    description: "UNSAFE: Allows all syscalls whilst logging their use. Similar to running as unconfined in terms of enforcement."
 spec:
   defaultAction: "SCMP_ACT_LOG"
-  targetWorkload: "example-profiles"
+  targetWorkload: "generic"
 ---
 apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
 kind: SeccompProfile
 metadata:
-  name: profile-allow
+  name: profile-allow-unsafe
+  annotations:
+    description: "UNSAFE: Allows all syscalls. Similar to running as unconfined as it provides no enforcement."
 spec:
   defaultAction: "SCMP_ACT_ALLOW"
-  targetWorkload: "example-profiles"
+  targetWorkload: "generic"
+---
+apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
+kind: SeccompProfile
+metadata:
+  name: profile-complain-block-high-risk
+  annotations:
+    description: "Enables complain mode whilst blocking high-risk syscalls. Some essential syscalls are allowed to decrease log noise."
+spec:
+  defaultAction: SCMP_ACT_LOG
+  targetWorkload: "generic"
+  architectures:
+  - SCMP_ARCH_X86_64
+  syscalls:
+  - action: SCMP_ACT_ALLOW
+    names:
+    - exit
+    - exit_group
+    - futex
+    - nanosleep
+
+  - action: SCMP_ACT_ERRNO
+    names:
+    - acct
+    - add_key
+    - bpf
+    - clock_adjtime
+    - clock_settime
+    - create_module
+    - delete_module
+    - finit_module
+    - get_kernel_syms
+    - get_mempolicy
+    - init_module
+    - ioperm
+    - iopl
+    - kcmp
+    - kexec_file_load
+    - kexec_load
+    - keyctl
+    - lookup_dcookie
+    - mbind
+    - mount
+    - move_pages
+    - name_to_handle_at
+    - nfsservctl
+    - open_by_handle_at
+    - perf_event_open
+    - personality
+    - pivot_root
+    - process_vm_readv
+    - process_vm_writev
+    - ptrace
+    - query_module
+    - quotactl
+    - reboot
+    - request_key
+    - set_mempolicy
+    - setns
+    - settimeofday
+    - stime
+    - swapoff
+    - swapon
+    - _sysctl
+    - sysfs
+    - umount2
+    - umount
+    - unshare
+    - uselib
+    - userfaultfd
+    - ustat
+    - vm86old
+    - vm86
diff --git a/installation-usage.md b/installation-usage.md
index cf1fe33bf..6d0154dc4 100644
--- a/installation-usage.md
+++ b/installation-usage.md
@@ -177,7 +177,7 @@ name matches the binding:
 
 ```sh
 $ kubectl get pod test-pod -o jsonpath='{.spec.containers[*].securityContext.seccompProfile}'
-{"localhostProfile":"operator/default/example-profiles/profile-complain.json","type":"Localhost"}
+{"localhostProfile":"operator/default/generic/profile-complain-unsafe.json","type":"Localhost"}
 ```
 
 #### Record profiles from workloads with ProfileRecordings
diff --git a/internal/pkg/controllers/spod/configmap_controller.go b/internal/pkg/controllers/spod/configmap_controller.go
index b7cab071f..34fbd97be 100644
--- a/internal/pkg/controllers/spod/configmap_controller.go
+++ b/internal/pkg/controllers/spod/configmap_controller.go
@@ -18,6 +18,7 @@ package spod
 
 import (
 	"context"
+	"fmt"
 	"strconv"
 
 	"github.com/crossplane/crossplane-runtime/pkg/event"
@@ -61,6 +62,22 @@ func (r *ReconcileSPOd) Reconcile(request reconcile.Request) (reconcile.Result,
 		}
 		return reconcile.Result{}, errors.Wrap(err, "getting spod configuration")
 	}
+
+	deploymentKey := types.NamespacedName{
+		Name:      config.OperatorName,
+		Namespace: config.GetOperatorNamespace(),
+	}
+	foundDeployment := &appsv1.Deployment{}
+	if err := r.client.Get(ctx, deploymentKey, foundDeployment); err != nil {
+		if kerrors.IsNotFound(err) {
+			return reconcile.Result{}, nil
+		}
+		return reconcile.Result{}, fmt.Errorf("error getting operator deployment: %w", err)
+	}
+	// We use the same target image for the deamonset as which we have right
+	// now running.
+	targetImage := foundDeployment.Spec.Template.Spec.Containers[0].Image
+
 	spodKey := types.NamespacedName{
 		Name:      r.baseSPOd.GetName(),
 		Namespace: config.GetOperatorNamespace(),
@@ -68,7 +85,7 @@ func (r *ReconcileSPOd) Reconcile(request reconcile.Request) (reconcile.Result,
 	foundSPOd := &appsv1.DaemonSet{}
 	if err := r.client.Get(ctx, spodKey, foundSPOd); err != nil {
 		if kerrors.IsNotFound(err) {
-			return r.handleCreate(ctx, cminstance)
+			return r.handleCreate(ctx, cminstance, targetImage)
 		}
 		return reconcile.Result{}, errors.Wrap(err, "getting spod DaemonSet")
 	}
@@ -77,9 +94,13 @@ func (r *ReconcileSPOd) Reconcile(request reconcile.Request) (reconcile.Result,
 	return reconcile.Result{}, nil
 }
 
-func (r *ReconcileSPOd) handleCreate(ctx context.Context, cfg *corev1.ConfigMap) (reconcile.Result, error) {
+func (r *ReconcileSPOd) handleCreate(
+	ctx context.Context,
+	cfg *corev1.ConfigMap,
+	image string,
+) (reconcile.Result, error) {
 	r.log.Info("Creating SPOd")
-	newSPOd := r.getConfiguredSPOd(cfg)
+	newSPOd := r.getConfiguredSPOd(cfg, image)
 
 	if err := controllerutil.SetControllerReference(cfg, newSPOd, r.scheme); err != nil {
 		return reconcile.Result{}, errors.Wrap(err, "setting spod controller reference")
@@ -94,27 +115,29 @@ func (r *ReconcileSPOd) handleCreate(ctx context.Context, cfg *corev1.ConfigMap)
 	return reconcile.Result{}, nil
 }
 
-func (r *ReconcileSPOd) getConfiguredSPOd(cfg *corev1.ConfigMap) *appsv1.DaemonSet {
+func (r *ReconcileSPOd) getConfiguredSPOd(cfg *corev1.ConfigMap, image string) *appsv1.DaemonSet {
 	newSPOd := r.baseSPOd.DeepCopy()
+	templateSpec := &newSPOd.Spec.Template.Spec
 
-	newSPOd.Spec.Template.Spec.Containers = []corev1.Container{r.baseSPOd.Spec.Template.Spec.Containers[0]}
+	templateSpec.Containers = []corev1.Container{r.baseSPOd.Spec.Template.Spec.Containers[0]}
+	templateSpec.Containers[0].Image = image
 
 	enableSelinux, err := strconv.ParseBool(cfg.Data[config.SPOcEnableSelinux])
 	if err == nil && enableSelinux {
-		newSPOd.Spec.Template.Spec.Containers = append(
-			newSPOd.Spec.Template.Spec.Containers,
+		templateSpec.Containers = append(
+			templateSpec.Containers,
 			r.baseSPOd.Spec.Template.Spec.Containers[1])
 
-		newSPOd.Spec.Template.Spec.Containers[0].Args = append(
-			newSPOd.Spec.Template.Spec.Containers[0].Args,
+		templateSpec.Containers[0].Args = append(
+			templateSpec.Containers[0].Args,
 			"--with-selinux=true")
 	}
 
 	imagePullPolicyStr, found := cfg.Data[config.SPOdImagePullPolicy]
 	if found {
 		pullPolicy := corev1.PullPolicy(imagePullPolicyStr)
-		for i := range newSPOd.Spec.Template.Spec.Containers {
-			newSPOd.Spec.Template.Spec.Containers[i].ImagePullPolicy = pullPolicy
+		for i := range templateSpec.Containers {
+			templateSpec.Containers[i].ImagePullPolicy = pullPolicy
 		}
 	}
 
diff --git a/internal/pkg/controllers/spod/setup.go b/internal/pkg/controllers/spod/setup.go
index 73f164352..e9a4e9604 100644
--- a/internal/pkg/controllers/spod/setup.go
+++ b/internal/pkg/controllers/spod/setup.go
@@ -37,7 +37,6 @@ const cmIsSPOdConfig = "security-profiles-operator/config"
 // SPOdTunables defines the parameters to tune/modify for the
 // Security-Profiles-Operator-Daemon.
 type DaemonTunables struct {
-	DaemonImage         string
 	NonRootEnablerImage string
 	SelinuxdImage       string
 	WatchNamespace      string
@@ -63,7 +62,6 @@ func getEffectiveSPOd(dt *DaemonTunables) *appsv1.DaemonSet {
 	refSPOd := bindata.Manifest.DeepCopy()
 
 	daemon := &refSPOd.Spec.Template.Spec.Containers[0]
-	daemon.Image = dt.DaemonImage
 	if dt.WatchNamespace != "" {
 		daemon.Env = append(daemon.Env, corev1.EnvVar{
 			Name:  config.RestrictNamespaceEnvKey,


Test patch:
diff --git a/internal/pkg/controllers/spod/setup_test.go b/internal/pkg/controllers/spod/setup_test.go
index 0cf82140f..b647ad270 100644
--- a/internal/pkg/controllers/spod/setup_test.go
+++ b/internal/pkg/controllers/spod/setup_test.go
@@ -34,13 +34,13 @@ func Test_getEffectiveSPOd(t *testing.T) {
 	}{
 		{
 			"Should correctly set the image",
-			DaemonTunables{"foo:bar", "bar:baz", "brot:wurst", ""},
+			DaemonTunables{"foo:bar", "bar:baz", "brot:wurst"},
 			false,
 			false,
 		},
 		{
 			"Should correctly set the namespace",
-			DaemonTunables{"foo:bar", "bar:baz", "brot:wurst", "my-ns"},
+			DaemonTunables{"foo:bar", "bar:baz", "brot:wurst"},
 			true,
 			false,
 		},
@@ -50,7 +50,6 @@ func Test_getEffectiveSPOd(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			got := getEffectiveSPOd(&tt.dt)
-			require.Equal(t, tt.dt.DaemonImage, got.Spec.Template.Spec.Containers[0].Image)
 			require.Equal(t, tt.dt.SelinuxdImage, got.Spec.Template.Spec.Containers[1].Image)
 			require.Equal(t, tt.dt.NonRootEnablerImage, got.Spec.Template.Spec.InitContainers[0].Image)
 			var found bool
diff --git a/test/e2e_test.go b/test/e2e_test.go
index 12113c7cc..046028277 100644
--- a/test/e2e_test.go
+++ b/test/e2e_test.go
@@ -77,10 +77,6 @@ func (e *e2e) TestSecurityProfilesOperator() {
 			"Seccomp: Re-deploy the operator",
 			e.testCaseReDeployOperator,
 		},
-		{
-			"Seccomp: Verify profile binding",
-			e.testCaseProfileBinding,
-		},
 		{
 			"SELinux: sanity check",
 			e.testCaseSelinuxSanityCheck,
@@ -91,10 +87,18 @@ func (e *e2e) TestSecurityProfilesOperator() {
 		},
 	}
 	for _, testCase := range testCases {
-		e.logf("> Running testcase: %s", testCase.description)
-		testCase.fn(nodes)
+		tc := testCase
+		e.Run("cluster-wide: "+tc.description, func() {
+			tc.fn(nodes)
+		})
 	}
 
+	// TODO(jaosorior): Re-introduce this to the namespaced tests once we
+	// fix the issue with the certs.
+	e.Run("cluster-wide: Seccomp: Verify profile binding", func() {
+		e.testCaseProfileBinding(nodes)
+	})
+
 	// Clean up cluster-wide deployment to prepare for namespace deployment
 	e.cleanupOperator(manifest, defaultProfiles)
 
@@ -120,8 +124,10 @@ func (e *e2e) TestSecurityProfilesOperator() {
 	e.deployOperator(namespaceManifest, namespaceDefaultProfiles)
 
 	for _, testCase := range testCases {
-		e.logf("> Running testcase: %s", testCase.description)
-		testCase.fn(nodes)
+		tc := testCase
+		e.Run("namespaced: "+tc.description, func() {
+			tc.fn(nodes)
+		})
 	}
 }
 
diff --git a/test/suite_test.go b/test/suite_test.go
index afab21b3e..1ecef631a 100644
--- a/test/suite_test.go
+++ b/test/suite_test.go
@@ -69,8 +69,11 @@ type openShifte2e struct {
 	skipBuildImages bool
 }
 
+// We're unable to use parallel tests because of our usage of testify/suite.
+// See https://github.com/stretchr/testify/issues/187
+//
+// nolint:paralleltest
 func TestSuite(t *testing.T) {
-	t.Parallel()
 	fmt.Printf("cluster-type: %s\n", clusterType)
 	fmt.Printf("container-runtime: %s\n", containerRuntime)
 
diff --git a/test/tc_default_profiles_test.go b/test/tc_default_profiles_test.go
index 909d321e0..aae4f6e0b 100644
--- a/test/tc_default_profiles_test.go
+++ b/test/tc_default_profiles_test.go
@@ -29,7 +29,7 @@ import (
 
 func (e *e2e) testCaseDefaultAndExampleProfiles(nodes []string) {
 	const exampleProfilePath = "examples/seccompprofile.yaml"
-	exampleProfileNames := [3]string{"profile-allow", "profile-complain", "profile-block"}
+	exampleProfileNames := [3]string{"profile-allow-unsafe", "profile-complain-unsafe", "profile-block-all"}
 	defaultProfileNames := [1]string{"nginx-1.19.1"}
 	e.kubectl("create", "-f", exampleProfilePath)
 	defer e.kubectl("delete", "-f", exampleProfilePath)
diff --git a/test/tc_profilebindings_test.go b/test/tc_profilebindings_test.go
index 6a2c4a50f..890dbdc34 100644
--- a/test/tc_profilebindings_test.go
+++ b/test/tc_profilebindings_test.go
@@ -33,7 +33,7 @@ metadata:
 spec:
   profileRef:
     kind: SeccompProfile
-    name: profile-allow
+    name: profile-allow-unsafe
   image: hello-world
 `
 	const testPod = `
@@ -103,7 +103,7 @@ spec:
 		"get", "pod", "hello",
 		"--output", "jsonpath={.spec.containers[0].securityContext.seccompProfile.localhostProfile}",
 	)
-	e.Equal(fmt.Sprintf("operator/%s/example-profiles/profile-allow.json", namespace), output)
+	e.Equal(fmt.Sprintf("operator/%s/generic/profile-allow-unsafe.json", namespace), output)
 
 	e.logf("Testing that profile binding has pod reference")
 	output = e.kubectl("get", "profilebinding", "hello-binding", "--output", "jsonpath={.status.activeWorkloads[0]}")
@@ -112,9 +112,13 @@ spec:
 	e.Equal("active-workload-lock", output)
 
 	e.logf("Testing that profile has pod reference")
-	output = e.kubectl("get", "seccompprofile", "profile-allow", "--output", "jsonpath={.status.activeWorkloads[0]}")
+	output = e.kubectl("get", "seccompprofile", "profile-allow-unsafe",
+		"--output", "jsonpath={.status.activeWorkloads[0]}")
+
 	e.Equal(fmt.Sprintf("%s/hello", namespace), output)
-	output = e.kubectl("get", "seccompprofile", "profile-allow", "--output", "jsonpath={.metadata.finalizers}")
+	output = e.kubectl("get", "seccompprofile", "profile-allow-unsafe",
+		"--output", "jsonpath={.metadata.finalizers}")
+
 	e.Contains(output, "in-use-by-active-pods")
 }