Repository: kubernetes-sigs/security-profiles-operator
Pull request #197 (2021-01-14 21:27:08)

Pre-req for common upgrade
#### What type of PR is this?

/kind feature

#### What this PR does / why we need it:

Enable `common` upgrade without adding a regression. 

#### Which issue(s) this PR fixes:

Relates to https://github.com/kubernetes-sigs/security-profiles-operator/issues/182

#### Special notes for your reviewer:

This is a pre-req for https://github.com/kubernetes-sigs/security-profiles-operator/pull/185

#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
NONE
```


k8s-ci-robot: Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with `/test all`
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/197#" title="Author self-approved">pjbgf</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [pjbgf]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
k8s-ci-robot: @pjbgf: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-security-profiles-operator-build | 16631d161b719c9badf560ccfc5890d7972a8f79 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/197/pull-security-profiles-operator-build/1349832339919736832) | `/test pull-security-profiles-operator-build`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=197). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Apjbgf). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @pjbgf: The following tests **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-security-profiles-operator-build | 16631d161b719c9badf560ccfc5890d7972a8f79 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/197/pull-security-profiles-operator-build/1349832339919736832) | `/test pull-security-profiles-operator-build`
pull-security-profiles-operator-test-unit | 16631d161b719c9badf560ccfc5890d7972a8f79 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/197/pull-security-profiles-operator-test-unit/1349832339961679872) | `/test pull-security-profiles-operator-test-unit`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=197). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Apjbgf). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->

Patch:
diff --git a/Dockerfile b/Dockerfile
index add5a0685..c715c9c01 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -14,7 +14,7 @@
 
 FROM golang:1.15-alpine AS build
 WORKDIR /work
-RUN apk --no-cache add build-base git gcc
+RUN apk --no-cache add build-base git gcc libseccomp-dev
 
 ENV USER=secuser
 ENV UID=2000
diff --git a/Makefile b/Makefile
index 7203626a6..09d783002 100644
--- a/Makefile
+++ b/Makefile
@@ -28,7 +28,7 @@ GIT_COMMIT := $(shell git rev-parse HEAD 2> /dev/null || echo unknown)
 GIT_TREE_STATE := $(if $(shell git status --porcelain --untracked-files=no),dirty,clean)
 VERSION := $(shell cat VERSION)
 
-BUILDTAGS := netgo osusergo
+BUILDTAGS := netgo osusergo seccomp
 BUILD_FILES := $(shell find . -type f -name '*.go' -or -name '*.mod' -or -name '*.sum' -not -name '*_test.go')
 export GOFLAGS?=-mod=mod
 GO_PROJECT := sigs.k8s.io/$(PROJECT)
@@ -150,7 +150,7 @@ $(BUILD_DIR)/golangci-lint:
 
 .PHONY: test-unit
 test-unit: $(BUILD_DIR) ## Run the unit tests
-	$(GO) test -ldflags '$(LDVARS)' -v -test.coverprofile=$(BUILD_DIR)/coverage.out ./internal/...
+	$(GO) test -ldflags '$(LDVARS)' -tags '$(BUILDTAGS)' -v -test.coverprofile=$(BUILD_DIR)/coverage.out ./internal/...
 	$(GO) tool cover -html $(BUILD_DIR)/coverage.out -o $(BUILD_DIR)/coverage.html
 
 .PHONY: test-e2e
diff --git a/deploy/base/operator.yaml b/deploy/base/operator.yaml
index 762ec6e44..11553d206 100644
--- a/deploy/base/operator.yaml
+++ b/deploy/base/operator.yaml
@@ -35,6 +35,9 @@ spec:
         - key: "node-role.kubernetes.io/master"
           operator: "Exists"
           effect: "NoSchedule"
+        - key: "node-role.kubernetes.io/control-plane"
+          operator: "Exists"
+          effect: "NoSchedule"
         - key: "node.kubernetes.io/not-ready"
           operator: "Exists"
           effect: "NoExecute"
\ No newline at end of file
diff --git a/deploy/namespace-operator.yaml b/deploy/namespace-operator.yaml
index 54a37ce83..82ef97884 100644
--- a/deploy/namespace-operator.yaml
+++ b/deploy/namespace-operator.yaml
@@ -516,6 +516,9 @@ spec:
       - effect: NoSchedule
         key: node-role.kubernetes.io/master
         operator: Exists
+      - effect: NoSchedule
+        key: node-role.kubernetes.io/control-plane
+        operator: Exists
       - effect: NoExecute
         key: node.kubernetes.io/not-ready
         operator: Exists
diff --git a/deploy/operator.yaml b/deploy/operator.yaml
index 58ecda022..a9197c736 100644
--- a/deploy/operator.yaml
+++ b/deploy/operator.yaml
@@ -514,6 +514,9 @@ spec:
       - effect: NoSchedule
         key: node-role.kubernetes.io/master
         operator: Exists
+      - effect: NoSchedule
+        key: node-role.kubernetes.io/control-plane
+        operator: Exists
       - effect: NoExecute
         key: node.kubernetes.io/not-ready
         operator: Exists
diff --git a/hack/pull-security-profiles-operator-build b/hack/pull-security-profiles-operator-build
index b43986733..047b20bd5 100755
--- a/hack/pull-security-profiles-operator-build
+++ b/hack/pull-security-profiles-operator-build
@@ -1,4 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+# assume a Debian based golang image, like: golang:1.15
+apt-get update
+apt-get install -y libseccomp-dev
+
 make
diff --git a/internal/pkg/controllers/selinuxpolicy/configmap_controller.go b/internal/pkg/controllers/selinuxpolicy/configmap_controller.go
index cd9629c84..09285af62 100644
--- a/internal/pkg/controllers/selinuxpolicy/configmap_controller.go
+++ b/internal/pkg/controllers/selinuxpolicy/configmap_controller.go
@@ -301,6 +301,11 @@ func newPodForPolicy(name, ns string, node *corev1.Node) *corev1.Pod {
 					Operator: "Exists",
 					Effect:   "NoSchedule",
 				},
+				{
+					Key:      "node-role.kubernetes.io/control-plane",
+					Operator: "Exists",
+					Effect:   "NoSchedule",
+				},
 			},
 		},
 	}
diff --git a/internal/pkg/controllers/spod/bindata/spod.go b/internal/pkg/controllers/spod/bindata/spod.go
index c87c52a42..8dd24cfa7 100644
--- a/internal/pkg/controllers/spod/bindata/spod.go
+++ b/internal/pkg/controllers/spod/bindata/spod.go
@@ -150,6 +150,8 @@ spec:
       tolerations:
         - effect: NoSchedule
           key: node-role.kubernetes.io/master
+        - effect: NoSchedule
+          key: node-role.kubernetes.io/control-plane
         - effect: NoExecute
           key: node.kubernetes.io/not-ready
           operator: Exists


Test patch:
diff --git a/hack/pull-security-profiles-operator-test-unit b/hack/pull-security-profiles-operator-test-unit
index 69adc0dc2..435920f02 100755
--- a/hack/pull-security-profiles-operator-test-unit
+++ b/hack/pull-security-profiles-operator-test-unit
@@ -1,4 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+# assume a Debian based golang image, like: golang:1.15
+apt-get update
+apt-get install -y libseccomp-dev
+
 make test-unit