Repository: kubernetes-sigs/security-profiles-operator
Pull request #294 (2021-02-11 12:37:43)

Add crun to base profile e2e test
#### What type of PR is this?

/kind cleanup


#### What this PR does / why we need it:
Since we now have a base profile for crun in place we can reuse the
existing test to switch them for the same scenario.

#### Which issue(s) this PR fixes:

<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.

Fixes #

or

None
-->
None
#### Does this PR have test?
Yes
<!--
If tests aren't applicable just write N/A.
-->

#### Special notes for your reviewer:
None
#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
None
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/294#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/294#pullrequestreview-588516245" title="LGTM">hasheddan</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/294#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [hasheddan,saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
JAORMX: /lgtm
/approve
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/294#pullrequestreview-588516245" title="LGTM">hasheddan</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/294#issuecomment-777430341" title="Approved">JAORMX</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/294#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [hasheddan,saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
k8s-ci-robot: New changes are detected. LGTM label has been removed.
saschagrunert: Let me give an updated crun a try.
codecov-io: # [Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/294?src=pr&el=h1) Report
> Merging [#294](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/294?src=pr&el=desc) (3d90c37) into [master](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/commit/4fb514709f381a38d1db2bd1988d89e68ea6d32d?el=desc) (4fb5147) will **not change** coverage.
> The diff coverage is `n/a`.

[![Impacted file tree graph](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/294/graphs/tree.svg?width=650&height=150&src=pr&token=37VIWSZ1ZT)](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/294?src=pr&el=tree)

```diff
@@           Coverage Diff           @@
##           master     #294   +/-   ##
=======================================
  Coverage   25.48%   25.48%           
=======================================
  Files           8        8           
  Lines         616      616           
=======================================
  Hits          157      157           
  Misses        441      441           
  Partials       18       18           
```

| Flag | Coverage Δ | |
|---|---|---|
| unittests | `25.48% <ø> (ø)` | |

Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags#carryforward-flags-in-the-pull-request-comment) to find out more.


------

[Continue to review full report at Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/294?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/294?src=pr&el=footer). Last update [4fb5147...3d90c37](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/294?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).

JAORMX: The e2e test failed downloading the fedora iso. Might want to close and re-open this to re-kick that test.
saschagrunert: > The e2e test failed downloading the fedora iso. Might want to close and re-open this to re-kick that test.

Yes this happened the second time today, let me provide a fix.

Patch:
diff --git a/.gitignore b/.gitignore
index d8073b22c..b74770193 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,4 @@
 .vagrant
 Vagrantfile
 build
+result
diff --git a/Makefile b/Makefile
index fa1ecf957..eb222c5fc 100644
--- a/Makefile
+++ b/Makefile
@@ -40,6 +40,7 @@ else
 LINT_BUILDTAGS := e2e,netgo,osusergo,-tools
 endif
 
+export CGO_ENABLED=1
 
 BUILD_FILES := $(shell find . -type f -name '*.go' -or -name '*.mod' -or -name '*.sum' -not -name '*_test.go')
 export GOFLAGS?=-mod=vendor
@@ -56,7 +57,7 @@ else
   LDFLAGS := -s -w -extldflags "-static" $(LDVARS)
 endif
 
-export CONTAINER_RUNTIME ?= $(if $(shell which podman),podman,docker)
+export CONTAINER_RUNTIME ?= $(if $(shell which podman 2>/dev/null),podman,docker)
 
 ifeq ($(CONTAINER_RUNTIME), podman)
     LOGIN_PUSH_OPTS="--tls-verify=false"
@@ -126,6 +127,19 @@ deployments: manifests ## Generate the deployment files with kustomize
 image: ## Build the container image
 	$(CONTAINER_RUNTIME) build -f $(DOCKERFILE) --build-arg version=$(VERSION) -t $(IMAGE) .
 
+.PHONY: nix
+nix: ## Build the binary via nix for the current system
+	nix-build nix
+
+.PHONY: nix-arm64
+nix-arm64: ## Build the binary via nix for arm64
+	nix-build nix/default-arm64.nix
+
+.PHONY: update-nixpkgs
+update-nixpkgs: ## Update the pinned nixpkgs to the latest master
+	@nix run -f channel:nixpkgs-unstable nix-prefetch-git -c nix-prefetch-git \
+		--no-deepClone https://github.com/nixos/nixpkgs > nix/nixpkgs.json
+
 # Verification targets
 
 .PHONY: verify
diff --git a/hack/ci/install-cri-o.sh b/hack/ci/install-cri-o.sh
index 9a3033b10..087f0b632 100755
--- a/hack/ci/install-cri-o.sh
+++ b/hack/ci/install-cri-o.sh
@@ -29,6 +29,13 @@ mv crio-* crio
 
 make -C crio
 
+# Use the latest crun release
+CRUN=0.17
+curl -sfL --retry 5 --retry-delay 3 --show-error \
+    https://github.com/containers/crun/releases/download/$CRUN/crun-$CRUN-linux-amd64 \
+    -o /usr/local/bin/crun
+chmod +x /usr/local/bin/crun
+
 chcon -u system_u -r object_r -t container_runtime_exec_t \
     /usr/local/bin/crio \
     /usr/local/bin/crio-status \
diff --git a/nix/default-arm64.nix b/nix/default-arm64.nix
new file mode 100644
index 000000000..edb5c734c
--- /dev/null
+++ b/nix/default-arm64.nix
@@ -0,0 +1,6 @@
+(import ./nixpkgs.nix {
+  crossSystem = {
+    config = "aarch64-unknown-linux-gnu";
+  };
+}).callPackage ./derivation.nix
+{ }
diff --git a/nix/default.nix b/nix/default.nix
new file mode 100644
index 000000000..3bf7c70fa
--- /dev/null
+++ b/nix/default.nix
@@ -0,0 +1,1 @@
+(import ./nixpkgs.nix { }).callPackage ./derivation.nix { }
diff --git a/nix/derivation.nix b/nix/derivation.nix
new file mode 100644
index 000000000..de9bd6883
--- /dev/null
+++ b/nix/derivation.nix
@@ -0,0 +1,24 @@
+{ pkgs, buildGoModule }:
+with pkgs; buildGoModule rec {
+  name = "security-profiles-operator";
+  src = ./..;
+  vendorSha256 = null;
+  doCheck = false;
+  outputs = [ "out" ];
+  nativeBuildInputs = with buildPackages; [
+    git
+    pkg-config
+    which
+  ];
+  buildInputs = [
+    glibc
+    glibc.static
+    (libseccomp.overrideAttrs (x: { dontDisableStatic = true; }))
+  ];
+  buildPhase = ''
+    make
+  '';
+  installPhase = ''
+    install -Dm755 -t $out build/security-profiles-operator
+  '';
+}
diff --git a/nix/nixpkgs.json b/nix/nixpkgs.json
new file mode 100644
index 000000000..84a2c1a31
--- /dev/null
+++ b/nix/nixpkgs.json
@@ -0,0 +1,10 @@
+{
+  "url": "https://github.com/nixos/nixpkgs",
+  "rev": "cc0da25d94f300f9098d3c8bae2106c7997805e4",
+  "date": "2021-02-10T15:00:01+01:00",
+  "path": "/nix/store/f7xw50gii6j3f88lfb7s7crzs6sdxwxi-nixpkgs",
+  "sha256": "0xarfhl988s5npnaqjgw6291pqcpa0pswaqfp05k8gvzrixs52q0",
+  "fetchSubmodules": false,
+  "deepClone": false,
+  "leaveDotGit": false
+}
diff --git a/nix/nixpkgs.nix b/nix/nixpkgs.nix
new file mode 100644
index 000000000..21e7f17a2
--- /dev/null
+++ b/nix/nixpkgs.nix
@@ -0,0 +1,8 @@
+let
+  json = builtins.fromJSON (builtins.readFile ./nixpkgs.json);
+  nixpkgs = import (builtins.fetchTarball {
+    name = "nixos-unstable";
+    url = "${json.url}/archive/${json.rev}.tar.gz";
+    inherit (json) sha256;
+  });
+in nixpkgs


Test patch:
diff --git a/test/suite_test.go b/test/suite_test.go
index 1c42f7e74..21bc5fdbe 100644
--- a/test/suite_test.go
+++ b/test/suite_test.go
@@ -53,6 +53,12 @@ var (
 	containerRuntime              = os.Getenv("CONTAINER_RUNTIME")
 )
 
+const (
+	clusterTypeKind      = "kind"
+	clusterTypeVanilla   = "vanilla"
+	clusterTypeOpenShift = "openshift"
+)
+
 type e2e struct {
 	suite.Suite
 	kubectlPath        string
@@ -105,7 +111,7 @@ func TestSuite(t *testing.T) {
 	}
 	selinuxdImage := "quay.io/jaosorior/selinuxd"
 	switch {
-	case clusterType == "" || strings.EqualFold(clusterType, "kind"):
+	case clusterType == "" || strings.EqualFold(clusterType, clusterTypeKind):
 		if testImage == "" {
 			testImage = config.OperatorName + ":latest"
 		}
@@ -121,7 +127,7 @@ func TestSuite(t *testing.T) {
 			},
 			"", "",
 		})
-	case strings.EqualFold(clusterType, "openshift"):
+	case strings.EqualFold(clusterType, clusterTypeOpenShift):
 		skipBuildImages, err := strconv.ParseBool(envSkipBuildImages)
 		if err != nil {
 			skipBuildImages = false
@@ -145,7 +151,7 @@ func TestSuite(t *testing.T) {
 			skipBuildImages,
 			skipPushImages,
 		})
-	case strings.EqualFold(clusterType, "vanilla"):
+	case strings.EqualFold(clusterType, clusterTypeVanilla):
 		if testImage == "" {
 			testImage = "localhost/" + config.OperatorName + ":latest"
 		}
diff --git a/test/tc_base_profiles_test.go b/test/tc_base_profiles_test.go
index f1019987d..cdec2840a 100644
--- a/test/tc_base_profiles_test.go
+++ b/test/tc_base_profiles_test.go
@@ -24,9 +24,15 @@ import (
 )
 
 func (e *e2e) testCaseBaseProfile([]string) {
-	e.seccompOnlyTestCase()
-	const baseProfilePath = "examples/baseprofile-runc.yaml"
-	const helloProfile = `
+	baseProfilePath := "examples/baseprofile-runc.yaml"
+	baseProfileName := "runc-v1.0.0-rc92"
+
+	if clusterType == clusterTypeVanilla {
+		baseProfilePath = "examples/baseprofile-crun.yaml"
+		baseProfileName = "crun-v0.17"
+	}
+
+	helloProfile := fmt.Sprintf(`
 apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
 kind: SeccompProfile
 metadata:
@@ -34,14 +40,15 @@ metadata:
 spec:
   defaultAction: SCMP_ACT_ERRNO
   targetWorkload: hello
-  baseProfileName: runc-v1.0.0-rc92
+  baseProfileName: %s
   syscalls:
   - action: SCMP_ACT_ALLOW
     names:
     - arch_prctl
     - set_tid_address
     - exit_group
-`
+`, baseProfileName)
+
 	const helloPod = `
 apiVersion: v1
 kind: Pod