Repository: kubernetes-sigs/security-profiles-operator
Pull request #1085 (2022-08-11 23:38:38)

build(deps): bump helm/chart-testing-action from 2.2.1 to 2.3.0
Bumps [helm/chart-testing-action](https://github.com/helm/chart-testing-action) from 2.2.1 to 2.3.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/helm/chart-testing-action/releases">helm/chart-testing-action's releases</a>.</em></p>
<blockquote>
<h2>v2.3.0</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: Typo in README by <a href="https://github.com/joehorsnell"><code>@​joehorsnell</code></a> in <a href="https://github-redirect.dependabot.com/helm/chart-testing-action/pull/81">helm/chart-testing-action#81</a></li>
<li>Specify target branch of ct lint in example workflow by <a href="https://github.com/jenting"><code>@​jenting</code></a> in <a href="https://github-redirect.dependabot.com/helm/chart-testing-action/pull/88">helm/chart-testing-action#88</a></li>
<li>chore: update yamllint version by <a href="https://github.com/DerekTBrown"><code>@​DerekTBrown</code></a> in <a href="https://github-redirect.dependabot.com/helm/chart-testing-action/pull/91">helm/chart-testing-action#91</a></li>
<li>update action to default chart-testing install to v3.7.0 by <a href="https://github.com/cpanato"><code>@​cpanato</code></a> in <a href="https://github-redirect.dependabot.com/helm/chart-testing-action/pull/94">helm/chart-testing-action#94</a></li>
<li>feat: add version override flags by <a href="https://github.com/DerekTBrown"><code>@​DerekTBrown</code></a> in <a href="https://github-redirect.dependabot.com/helm/chart-testing-action/pull/92">helm/chart-testing-action#92</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/joehorsnell"><code>@​joehorsnell</code></a> made their first contribution in <a href="https://github-redirect.dependabot.com/helm/chart-testing-action/pull/81">helm/chart-testing-action#81</a></li>
<li><a href="https://github.com/jenting"><code>@​jenting</code></a> made their first contribution in <a href="https://github-redirect.dependabot.com/helm/chart-testing-action/pull/88">helm/chart-testing-action#88</a></li>
<li><a href="https://github.com/DerekTBrown"><code>@​DerekTBrown</code></a> made their first contribution in <a href="https://github-redirect.dependabot.com/helm/chart-testing-action/pull/91">helm/chart-testing-action#91</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/helm/chart-testing-action/compare/v2.2.1...v2.3.0">https://github.com/helm/chart-testing-action/compare/v2.2.1...v2.3.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/helm/chart-testing-action/commit/09ed88797198755e5031f25be13da255e7e33aad"><code>09ed887</code></a> feat: add version override flags (<a href="https://github-redirect.dependabot.com/helm/chart-testing-action/issues/92">#92</a>)</li>
<li><a href="https://github.com/helm/chart-testing-action/commit/6930ae8e9b30df5b66b36af291de4577962051b5"><code>6930ae8</code></a> update action to default chart-testing install to v3.7.0 (<a href="https://github-redirect.dependabot.com/helm/chart-testing-action/issues/94">#94</a>)</li>
<li><a href="https://github.com/helm/chart-testing-action/commit/729b0c144cc1447215a65964682fd6d8ee7a5152"><code>729b0c1</code></a> chore: update yamllint version (<a href="https://github-redirect.dependabot.com/helm/chart-testing-action/issues/91">#91</a>)</li>
<li><a href="https://github.com/helm/chart-testing-action/commit/e38d23e463607d96fd08c2464363b1ce104446d3"><code>e38d23e</code></a> Specify target branch of ct lint in example workflow (<a href="https://github-redirect.dependabot.com/helm/chart-testing-action/issues/88">#88</a>)</li>
<li><a href="https://github.com/helm/chart-testing-action/commit/c027be8bc4049de5fee5d05cb300bcbbdebb2903"><code>c027be8</code></a> fix: Typo in README (<a href="https://github-redirect.dependabot.com/helm/chart-testing-action/issues/81">#81</a>)</li>
<li>See full diff in <a href="https://github.com/helm/chart-testing-action/compare/v2.2.1...v2.3.0">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=helm/chart-testing-action&package-manager=github_actions&previous-version=2.2.1&new-version=2.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

k8s-ci-robot: Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a [kubernetes-sigs](https://github.com/orgs/kubernetes-sigs/people) member to verify that this patch is reasonable to test. If it is, they should reply with `/ok-to-test` on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should [join the org](https://git.k8s.io/community/community-membership.md#member) to skip this step.

Once the patch is verified, the new status will be reflected by the `ok-to-test` label.

I understand the commands that are listed [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>

k8s-ci-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1085#" title="Author self-approved">dependabot[bot]</a>*
**Once this PR has been reviewed and has the lgtm label**, please assign saschagrunert for approval by writing `/assign @saschagrunert` in a comment. For more information see:[The Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["saschagrunert"]} -->
codecov-commenter: # [Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/1085?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) Report
> Merging [#1085](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/1085?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) (4a98ced) into [main](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/commit/5b7057096bd68bbc45c7db97aa7314529951ff2c?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) (5b70570) will **not change** coverage.
> The diff coverage is `n/a`.

```diff
@@           Coverage Diff           @@
##             main    #1085   +/-   ##
=======================================
  Coverage   50.43%   50.43%           
=======================================
  Files          42       42           
  Lines        4761     4761           
=======================================
  Hits         2401     2401           
  Misses       2281     2281           
  Partials       79       79           
```


Patch:
diff --git a/.github/workflows/helm-chart-lint.yaml b/.github/workflows/helm-chart-lint.yaml
index 16fad5f42..f1c640682 100644
--- a/.github/workflows/helm-chart-lint.yaml
+++ b/.github/workflows/helm-chart-lint.yaml
@@ -39,7 +39,7 @@ jobs:
           python-version: 3.7
 
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@v2.2.1
+        uses: helm/chart-testing-action@v2.3.0
 
       - name: Run chart-testing (lint)
         run: >
diff --git a/go.mod b/go.mod
index b59b717dd..6082bbf8f 100644
--- a/go.mod
+++ b/go.mod
@@ -35,6 +35,7 @@ require (
 	sigs.k8s.io/controller-tools v0.9.2
 	sigs.k8s.io/mdtoc v1.1.0
 	sigs.k8s.io/release-utils v0.7.3
+	sigs.k8s.io/yaml v1.3.0
 	sigs.k8s.io/zeitgeist v0.3.1
 )
 
@@ -163,5 +164,4 @@ require (
 	sigs.k8s.io/kustomize/kyaml v0.13.6 // indirect
 	sigs.k8s.io/release-sdk v0.9.2 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.2.1 // indirect
-	sigs.k8s.io/yaml v1.3.0 // indirect
 )


Test patch:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b7719e47d..ccc44aef7 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -74,7 +74,7 @@ jobs:
       RUN: ./hack/ci/run-fedora.sh
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
-      - uses: actions/cache@f4278025ab0f432ce369118909e46deec636f50c
+      - uses: actions/cache@a7c34adf76222e77931dedbf4a45b2e4648ced19
         with:
           path: |
             ~/.vagrant.d/boxes
@@ -107,7 +107,7 @@ jobs:
       RUN: ./hack/ci/run-ubuntu.sh
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
-      - uses: actions/cache@f4278025ab0f432ce369118909e46deec636f50c
+      - uses: actions/cache@a7c34adf76222e77931dedbf4a45b2e4648ced19
         with:
           path: |
             ~/.vagrant.d/boxes
@@ -143,7 +143,7 @@ jobs:
        run: |
          echo "::set-output name=version::$(curl -s  https://stable.release.flatcar-linux.net/amd64-usr/current/flatcar_production_vagrant.json | jq '.versions[0].version' | tr -d '".')"
        shell: bash
-     - uses: actions/cache@f4278025ab0f432ce369118909e46deec636f50c
+     - uses: actions/cache@a7c34adf76222e77931dedbf4a45b2e4648ced19
        with:
          path: |
            ~/.vagrant.d/boxes
diff --git a/test/e2e_test.go b/test/e2e_test.go
index 180eb1966..d1af87cd1 100644
--- a/test/e2e_test.go
+++ b/test/e2e_test.go
@@ -62,12 +62,6 @@ func (e *e2e) TestSecurityProfilesOperator() {
 	// Deploy the operator
 	e.deployOperator(e.operatorManifest)
 
-	// On some distros (OCP), the SA needs to give additional
-	// roles to the workload, like the ability to use custom
-	// profiles for pods that are spawned by a replicating
-	// controller
-	e.setupRecordingSa()
-
 	// Retrieve the inputs for the test cases
 	nodes := e.getWorkerNodes()
 
@@ -395,6 +389,14 @@ func (e *e2e) getCurrentContextNamespace(alt string) string {
 }
 
 func (e *e2e) writeAndCreate(manifest, filePattern string) func() {
+	return e.writeAndDo("create", manifest, filePattern)
+}
+
+func (e *e2e) writeAndApply(manifest, filePattern string) func() {
+	return e.writeAndDo("apply", manifest, filePattern)
+}
+
+func (e *e2e) writeAndDo(verb, manifest, filePattern string) func() {
 	file, err := os.CreateTemp("", filePattern)
 	fileName := file.Name()
 	e.Nil(err)
@@ -402,7 +404,7 @@ func (e *e2e) writeAndCreate(manifest, filePattern string) func() {
 	e.Nil(err)
 	err = file.Close()
 	e.Nil(err)
-	e.kubectl("create", "-f", fileName)
+	e.kubectl(verb, "-f", fileName)
 	return func() { os.Remove(fileName) }
 }
 
diff --git a/test/recording_role.yaml b/test/recording_role.yaml
deleted file mode 100644
index 8d5191182..000000000
--- a/test/recording_role.yaml
+++ /dev/null
@@ -1,14 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  creationTimestamp: null
-  name: recording
-rules:
-- apiGroups:
-  - security.openshift.io
-  resources:
-  - securitycontextconstraints
-  resourceNames:
-  - privileged
-  verbs:
-  - use
diff --git a/test/recording_role_binding.yaml b/test/recording_role_binding.yaml
deleted file mode 100644
index 0de6041fe..000000000
--- a/test/recording_role_binding.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  labels:
-    app: recording
-  name: recording
-subjects:
-- kind: ServiceAccount
-  name: recording-sa
-roleRef:
-  kind: Role
-  name: recording
-  apiGroup: rbac.authorization.k8s.io
diff --git a/test/recording_sa.yaml b/test/recording_sa.yaml
deleted file mode 100644
index ed288aa30..000000000
--- a/test/recording_sa.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  creationTimestamp: null
-  name: recording-sa
diff --git a/test/suite_test.go b/test/suite_test.go
index 0a1d10335..cd37a6869 100644
--- a/test/suite_test.go
+++ b/test/suite_test.go
@@ -100,7 +100,7 @@ type e2e struct {
 	execNode               func(node string, args ...string) string
 	waitForReadyPods       func()
 	deployCertManager      func()
-	setupRecordingSa       func()
+	setupRecordingSa       func(namespace string)
 }
 
 func defaultWaitForReadyPods(e *e2e) {
@@ -455,24 +455,23 @@ func (e *openShifte2e) execNodeOCP(node string, args ...string) string {
 }
 
 func (e *e2e) waitForReadyPodsOCP() {
-	// intentionally blank, it is presumed a test driver or the developer
+	// intentionally not waiting for pods, it is presumed a test driver or the developer
 	// ensure the cluster is up before the test runs. At least for now.
-}
-
-func (e *e2e) deployCertManagerOCP() {
-	// intentionally blank, OCP creates certs on its own
-}
 
-func (e *e2e) deployRecordingSaOcp() {
 	// this is a kludge to help run the tests on OCP CI where there's a ephemeral namespace that goes away
 	// as the test is starting. Without explicitly setting the namespace, the OCP CI tests fail with:
 	// error when creating "test/recording_sa.yaml": namespaces "ci-op-hq1cv14k" not found
-	e.kubectl("config", "set-context", "--current", "--namespace", "security-profiles-operator")
+	e.kubectl("config", "set-context", "--current", "--namespace", config.OperatorName)
+}
 
-	e.deployRecordingSa()
+func (e *e2e) deployCertManagerOCP() {
+	// intentionally blank, OCP creates certs on its own
+}
 
-	e.kubectl("create", "-f", "test/recording_role.yaml")
-	e.kubectl("create", "-f", "test/recording_role_binding.yaml")
+func (e *e2e) deployRecordingSaOcp(namespace string) {
+	e.deployRecordingSa(namespace)
+	e.deployRecordingRole(namespace)
+	e.deployRecordingRoleBinding(namespace)
 }
 
 func (e *vanilla) SetupSuite() {
@@ -759,6 +758,66 @@ func (e *e2e) enableLabelingPodDenials() {
 	e.kubectlOperatorNS("rollout", "status", "ds", "spod", "--timeout", defaultLabelPodDenialsTimeout)
 }
 
-func (e *e2e) deployRecordingSa() {
-	e.kubectl("create", "-f", "test/recording_sa.yaml")
+func (e *e2e) deployRecordingSa(namespace string) {
+	saTemplate := `
+    apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      creationTimestamp: null
+      name: recording-sa
+      namespace: %s
+`
+
+	e.applyFromTemplate(saTemplate, namespace)
+}
+
+func (e *e2e) deployRecordingRole(namespace string) {
+	roleTemplate := `
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: Role
+    metadata:
+      creationTimestamp: null
+      name: recording
+      namespace: %s
+    rules:
+    - apiGroups:
+      - security.openshift.io
+      resources:
+      - securitycontextconstraints
+      resourceNames:
+      - privileged
+      - anyuid
+      verbs:
+      - use
+`
+
+	e.applyFromTemplate(roleTemplate, namespace)
+}
+
+func (e *e2e) deployRecordingRoleBinding(namespace string) {
+	roleBindingTemplate := `
+    kind: RoleBinding
+    apiVersion: rbac.authorization.k8s.io/v1
+    metadata:
+      labels:
+        app: recording
+      name: recording
+      namespace: %s
+    subjects:
+    - kind: ServiceAccount
+      name: recording-sa
+    roleRef:
+      kind: Role
+      name: recording
+      apiGroup: rbac.authorization.k8s.io
+`
+
+	e.applyFromTemplate(roleBindingTemplate, namespace)
+}
+
+func (e *e2e) applyFromTemplate(template, namespace string) {
+	manifestFile := "templated-manifest.yaml"
+	manifest := fmt.Sprintf(template, namespace)
+	deleteSaFn := e.writeAndApply(manifest, manifestFile)
+	deleteSaFn()
 }
diff --git a/test/tc_profilerecordings_test.go b/test/tc_profilerecordings_test.go
index 36bc47851..c49756c58 100644
--- a/test/tc_profilerecordings_test.go
+++ b/test/tc_profilerecordings_test.go
@@ -331,6 +331,8 @@ func (e *e2e) createRecordingTestDeployment() (since time.Time, podName string)
 	e.logf("Creating test deployment")
 	podName = "my-deployment"
 
+	e.setupRecordingSa(e.getCurrentContextNamespace(defaultNamespace))
+
 	const testDeployment = `
 apiVersion: apps/v1
 kind: Deployment
diff --git a/test/tc_run_pod_test.go b/test/tc_run_pod_test.go
index e2362d55a..231fbce02 100644
--- a/test/tc_run_pod_test.go
+++ b/test/tc_run_pod_test.go
@@ -16,22 +16,63 @@ limitations under the License.
 
 package e2e_test
 
+import (
+	"os"
+
+	corev1 "k8s.io/api/core/v1"
+	"sigs.k8s.io/yaml"
+)
+
 func (e *e2e) testCaseRunPod([]string) {
 	e.seccompOnlyTestCase()
 	const (
 		examplePodPath = "examples/pod.yaml"
 		examplePodName = "test-pod"
+		testPodFname   = "test-pod.yaml"
 	)
 
 	namespace := e.getCurrentContextNamespace(defaultNamespace)
+
+	e.setupRecordingSa(namespace)
+
 	if namespace != defaultNamespace {
 		e.updateManifest(examplePodPath, "security-profiles-operator", namespace)
 		defer e.run("git", "checkout", examplePodPath)
 	}
 
+	bs, err := os.ReadFile(examplePodPath)
+	e.Nil(err)
+
+	var testPod corev1.Pod
+	err = yaml.Unmarshal(bs, &testPod)
+	e.Nil(err)
+
+	// the example pod runs as root by default. Since this is a valid and valuable
+	// test case, but at the same time we don't want to pollute the example with OCP
+	// specific settings, let's change the pod on the fly when running on OCP.
+	if clusterType == clusterTypeOpenShift {
+		zero := int64(0)
+
+		// without anyuid, the pod can't set a custom UID
+		testPod.Annotations["openshift.io/scc"] = "anyuid"
+		// this SA allows using more privileged SCCs
+		testPod.Spec.ServiceAccountName = "recording-sa"
+		// force running as root
+		for cidx := range testPod.Spec.Containers {
+			cnt := &testPod.Spec.Containers[cidx]
+			cnt.SecurityContext = &corev1.SecurityContext{
+				RunAsUser: &zero,
+			}
+		}
+	}
+
 	e.logf("Creating the test pod: %s", examplePodPath)
-	e.kubectl("create", "-f", examplePodPath)
-	defer e.kubectl("delete", "-f", examplePodPath)
+	testPodBytes, err := yaml.Marshal(testPod)
+	e.Nil(err)
+	testPodManifest := string(testPodBytes)
+	deleteCurNsFn := e.writeAndCreate(testPodManifest, testPodFname)
+	defer e.kubectl("delete", "pods", examplePodName)
+	defer deleteCurNsFn()
 
 	e.logf("Waiting for test pod to be ready")
 	e.waitFor("condition=ready", "pod", "--all")