Repository: kubernetes-sigs/security-profiles-operator
Pull request #315 (2021-02-17 14:52:33)

Add dedicated build image hosted on quay.io

#### What type of PR is this?

/kind cleanup


#### What this PR does / why we need it:
After this patch gets merged we will setup the auto-build on quay.io to
continuously update our build image.
#### Which issue(s) this PR fixes:

<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.

Fixes #

or

None
-->
None
#### Does this PR have test?
None
<!--
If tests aren't applicable just write N/A.
-->

#### Special notes for your reviewer:
None
#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
None
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/315#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
codecov-io: # [Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/315?src=pr&el=h1) Report
> Merging [#315](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/315?src=pr&el=desc) (56abc74) into [master](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/commit/1f3c99036a1533e80a0202b9397eee048d9bb5a8?el=desc) (1f3c990) will **not change** coverage.
> The diff coverage is `n/a`.

[![Impacted file tree graph](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/315/graphs/tree.svg?width=650&height=150&src=pr&token=37VIWSZ1ZT)](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/315?src=pr&el=tree)

```diff
@@           Coverage Diff           @@
##           master     #315   +/-   ##
=======================================
  Coverage   28.17%   28.17%           
=======================================
  Files           9        9           
  Lines         653      653           
=======================================
  Hits          184      184           
  Misses        450      450           
  Partials       19       19           
```

| Flag | Coverage Δ | |
|---|---|---|
| unittests | `28.17% <ø> (ø)` | |

Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags#carryforward-flags-in-the-pull-request-comment) to find out more.


------

[Continue to review full report at Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/315?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/315?src=pr&el=footer). Last update [1f3c990...56abc74](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/315?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).


Patch:
diff --git a/Dockerfile b/Dockerfile
index f1c48e502..c4305b2fb 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -12,36 +12,12 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM k8s.gcr.io/build-image/debian-base:buster-v1.4.0 AS build
-WORKDIR /work
-
-RUN apt-get update && apt-get install -y wget xz-utils
-
-ENV USER=root
-
-ARG NIX_VERSION=2.3.10
-RUN wget https://nixos.org/releases/nix/nix-${NIX_VERSION}/nix-${NIX_VERSION}-x86_64-linux.tar.xz && \
-    tar xf nix-${NIX_VERSION}-x86_64-linux.tar.xz && \
-    groupadd -r -g 30000 nixbld && \
-    for i in $(seq 1 30); do useradd -rM -u $((30000 + i)) -G nixbld nixbld$i ; done && \
-    mkdir -m 0755 /etc/nix /nix && \
-    printf "sandbox = false\nfilter-syscalls = false\n" > /etc/nix/nix.conf && \
-    nix-${NIX_VERSION}-x86_64-linux/install && \
-    ln -s /nix/var/nix/profiles/default/etc/profile.d/nix.sh /etc/profile.d
-
-ENV ENV=/etc/profile \
-    PATH=/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin \
-    GIT_SSL_CAINFO=/etc/ssl/certs/ca-certificates.crt \
-    NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt \
-    NIX_PATH=/nix/var/nix/profiles/per-user/root/channels
+FROM quay.io/security-profiles-operator/build:latest AS build
 
 COPY . /work
 
 FROM build as make
 
-RUN nix-env -iA cachix -f https://cachix.org/api/v1/install
-RUN cachix use security-profiles-operator
-
 ARG target=nix
 RUN nix-build $target
 
diff --git a/hack/build-image/Dockerfile b/hack/build-image/Dockerfile
new file mode 100644
index 000000000..9c2727470
--- /dev/null
+++ b/hack/build-image/Dockerfile
@@ -0,0 +1,44 @@
+# Copyright 2021 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+FROM k8s.gcr.io/build-image/debian-base:buster-v1.4.0
+WORKDIR /work
+
+RUN apt-get update && apt-get install -y wget xz-utils
+
+ENV USER=root
+
+ARG NIX_VERSION=2.3.10
+RUN wget https://nixos.org/releases/nix/nix-${NIX_VERSION}/nix-${NIX_VERSION}-x86_64-linux.tar.xz && \
+    tar xf nix-${NIX_VERSION}-x86_64-linux.tar.xz && \
+    groupadd -r -g 30000 nixbld && \
+    for i in $(seq 1 30); do useradd -rM -u $((30000 + i)) -G nixbld nixbld$i ; done && \
+    mkdir -m 0755 /etc/nix /nix && \
+    printf "sandbox = false\nfilter-syscalls = false\n" > /etc/nix/nix.conf && \
+    nix-${NIX_VERSION}-x86_64-linux/install && \
+    ln -s /nix/var/nix/profiles/default/etc/profile.d/nix.sh /etc/profile.d && \
+    rm -rf nix-*
+
+ENV ENV=/etc/profile \
+    PATH=/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin \
+    GIT_SSL_CAINFO=/etc/ssl/certs/ca-certificates.crt \
+    NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt \
+    NIX_PATH=/nix/var/nix/profiles/per-user/root/channels
+
+RUN nix-collect-garbage --delete-old -d && \
+    nix-store --optimise && \
+    nix-store --verify --check-contents
+
+RUN nix-env -iA cachix -f https://cachix.org/api/v1/install && \
+    cachix use security-profiles-operator


Test patch:
diff --git a/test/e2e_test.go b/test/e2e_test.go
index 2c80e8fce..23ecc63e6 100644
--- a/test/e2e_test.go
+++ b/test/e2e_test.go
@@ -105,7 +105,8 @@ func (e *e2e) TestSecurityProfilesOperator() {
 	})
 
 	e.Run("cluster-wide: Seccomp: Verify profile recording", func() {
-		e.testCaseProfileRecording(nodes)
+		e.testCaseProfileRecordingStaticPod()
+		e.testCaseProfileRecordingKubectlRun()
 	})
 
 	e.cleanupWebhook(webhookManifest)
diff --git a/test/tc_profilerecordings_test.go b/test/tc_profilerecordings_test.go
index 57cd0e57f..23b4929a7 100644
--- a/test/tc_profilerecordings_test.go
+++ b/test/tc_profilerecordings_test.go
@@ -21,10 +21,13 @@ import (
 	"os"
 )
 
-func (e *e2e) testCaseProfileRecording([]string) {
-	e.profileRecordingTestCase()
+const (
+	exampleRecordingPath = "examples/profilerecording.yaml"
+	recordingName        = "test-recording"
+)
 
-	const exampleRecordingPath = "examples/profilerecording.yaml"
+func (e *e2e) testCaseProfileRecordingStaticPod() {
+	e.profileRecordingTestCase()
 
 	e.logf("Creating recording")
 	e.kubectl("create", "-f", exampleRecordingPath)
@@ -58,6 +61,26 @@ spec:
 	e.waitFor("condition=ready", "pod", "recording")
 	e.kubectl("delete", "pod", "recording")
 
-	profile := e.kubectl("get", "sp", "test-recording", "-o", "yaml")
+	profile := e.kubectl("get", "sp", recordingName, "-o", "yaml")
+	defer e.kubectl("delete", "sp", recordingName)
 	e.Contains(profile, "mkdir")
 }
+
+func (e *e2e) testCaseProfileRecordingKubectlRun() {
+	e.profileRecordingTestCase()
+
+	e.logf("Creating recording")
+	e.kubectl("create", "-f", exampleRecordingPath)
+	defer e.kubectl("delete", "-f", exampleRecordingPath)
+
+	e.logf("Creating test pod")
+	e.kubectl(
+		"run", "--rm", "-it", "--restart=Never", "--labels=app=alpine",
+		"--image=registry.fedoraproject.org/fedora-minimal:latest",
+		"test", "--", "echo", "test",
+	)
+
+	profile := e.kubectl("get", "sp", recordingName, "-o", "yaml")
+	e.Contains(profile, "prctl")
+	e.NotContains(profile, "mkdir")
+}