Repository: kubernetes-sigs/security-profiles-operator
Pull request #260 (2021-02-03 09:47:02)

Expand on seccomp example profiles
#### What type of PR is this?

/kind documentation

#### What this PR does / why we need it:

- Create a seccomp profile that is safer for production workloads. It is slightly more restrictive than the docker default and also auto allows essential calls to reduce log noise. This can also be used as template for users to test their seccomp profiles in production before setting in the enforcer mode.
- Change `targetWorkload` from seccomp profile examples to `generic`. A point of discussion here would be to ship them in by default in the future.
- Add description to each profile to clarify their meaning and highlight unsafe profiles.

#### Which issue(s) this PR fixes:

None


#### Does this PR have test?

N/A

#### Special notes for your reviewer:

#### Does this PR introduce a user-facing change?

```release-note
Add complain-mode seccomp profile that is safer to run in production workloads
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/260#" title="Author self-approved">pjbgf</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [pjbgf]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
codecov-io: # [Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/260?src=pr&el=h1) Report
> Merging [#260](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/260?src=pr&el=desc) (1c16fde) into [master](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/commit/64085f1a22335bbf2526ba2623a56cc31e4bd876?el=desc) (64085f1) will **not change** coverage.
> The diff coverage is `n/a`.

[![Impacted file tree graph](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/260/graphs/tree.svg?width=650&height=150&src=pr&token=37VIWSZ1ZT)](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/260?src=pr&el=tree)

```diff
@@           Coverage Diff           @@
##           master     #260   +/-   ##
=======================================
  Coverage   30.25%   30.25%           
=======================================
  Files           5        5           
  Lines         476      476           
=======================================
  Hits          144      144           
  Misses        315      315           
  Partials       17       17           
```

| Flag | Coverage Δ | |
|---|---|---|
| unittests | `30.25% <ø> (ø)` | |

Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags#carryforward-flags-in-the-pull-request-comment) to find out more.


------

[Continue to review full report at Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/260?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/260?src=pr&el=footer). Last update [64085f1...1c16fde](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/260?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).

k8s-ci-robot: @pjbgf: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 1c16fdef1017c22b1eed2d500ebbf407f31758b9 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/260/pull-security-profiles-operator-test-e2e/1356902009634033664) | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=260). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Apjbgf). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
pjbgf: /test pull-security-profiles-operator-test-e2e
k8s-ci-robot: @pjbgf: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 1c16fdef1017c22b1eed2d500ebbf407f31758b9 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/260/pull-security-profiles-operator-test-e2e/1356904002821820416) | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=260). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Apjbgf). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @pjbgf: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 543df785032e4159c3830b856cf32fad9756c0cc | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/260/pull-security-profiles-operator-test-e2e/1356909297027518464) | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=260). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Apjbgf). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @pjbgf: The following tests **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 543df785032e4159c3830b856cf32fad9756c0cc | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/260/pull-security-profiles-operator-test-e2e/1356909297027518464) | `/test pull-security-profiles-operator-test-e2e`
pull-security-profiles-operator-verify | 22598a5c7ae446975255efc0bbe0da75d06f6705 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/260/pull-security-profiles-operator-verify/1356923842978648064) | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=260). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Apjbgf). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->

Patch:
diff --git a/Makefile b/Makefile
index 5ae51de47..f2640bbbb 100644
--- a/Makefile
+++ b/Makefile
@@ -176,7 +176,7 @@ test-unit: $(BUILD_DIR) ## Run the unit tests
 
 .PHONY: test-e2e
 test-e2e: ## Run the end-to-end tests
-	$(GO) test -race -timeout 40m -count=1 ./test/... -v
+	$(GO) test -parallel 1 -timeout 40m -count=1 ./test/... -v
 
 # Generate CRD manifests
 manifests: $(CONTROLLER_GEN)
diff --git a/cmd/security-profiles-operator/main.go b/cmd/security-profiles-operator/main.go
index 162ad8baf..38160773b 100644
--- a/cmd/security-profiles-operator/main.go
+++ b/cmd/security-profiles-operator/main.go
@@ -20,6 +20,7 @@ import (
 	"context"
 	"fmt"
 	"os"
+	"strings"
 	"time"
 
 	"github.com/go-logr/logr"
@@ -27,6 +28,7 @@ import (
 	"github.com/urfave/cli/v2"
 	"k8s.io/klog/v2/klogr"
 	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/cache"
 	"sigs.k8s.io/controller-runtime/pkg/manager"
 	"sigs.k8s.io/controller-runtime/pkg/scheme"
 
@@ -169,7 +171,16 @@ func runManager(ctx *cli.Context) error {
 	}
 
 	if dt.WatchNamespace != "" {
-		ctrlOpts.Namespace = dt.WatchNamespace
+		// TODO(jaosorior): Handle multiple namespaces coming from the tunables
+		namespaces := []string{
+			dt.WatchNamespace,
+			// We add the operator's namespace so this also is able to
+			// listen to the configuration might not be in the namespace
+			// folks will be deploying policies to.
+			config.GetOperatorNamespace(),
+		}
+		setupLog.Info(fmt.Sprintf("Listening on namespace(s): %s", strings.Join(namespaces, ", ")))
+		ctrlOpts.NewCache = cache.MultiNamespacedCacheBuilder(namespaces)
 	}
 
 	mgr, err := ctrl.NewManager(cfg, ctrlOpts)
diff --git a/examples/pod.yaml b/examples/pod.yaml
index 303aa07c8..dca54741e 100644
--- a/examples/pod.yaml
+++ b/examples/pod.yaml
@@ -8,7 +8,7 @@ metadata:
     # Or one example within this directory
     # Please note the syntax:
     # `localhost/operator/{namespace}/{configmap-name}/{profile-name}`
-    # seccomp.security.alpha.kubernetes.io/pod: 'localhost/operator/default/example-profiles/profile-allow.json'
+    # seccomp.security.alpha.kubernetes.io/pod: 'localhost/operator/default/generic/profile-allow-unsafe.json'
 spec:
   containers:
   - name: test-container
diff --git a/examples/profilebinding.yaml b/examples/profilebinding.yaml
index ac3cab91d..6b19ce2d3 100644
--- a/examples/profilebinding.yaml
+++ b/examples/profilebinding.yaml
@@ -6,5 +6,5 @@ metadata:
 spec:
   profileRef:
     kind: SeccompProfile
-    name: profile-allow
+    name: profile-allow-unsafe
   image: nginx:1.19.1
diff --git a/examples/seccompprofile.yaml b/examples/seccompprofile.yaml
index fe1d54a82..a0b583477 100644
--- a/examples/seccompprofile.yaml
+++ b/examples/seccompprofile.yaml
@@ -2,23 +2,101 @@
 apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
 kind: SeccompProfile
 metadata:
-  name: profile-block
+  name: profile-block-all
+  annotations:
+    description: "Blocks all syscalls."
 spec:
   defaultAction: "SCMP_ACT_ERRNO"
-  targetWorkload: "example-profiles"
+  targetWorkload: "generic"
 ---
 apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
 kind: SeccompProfile
 metadata:
-  name: profile-complain
+  name: profile-complain-unsafe
+  annotations:
+    description: "UNSAFE: Allows all syscalls whilst logging their use. Similar to running as unconfined in terms of enforcement."
 spec:
   defaultAction: "SCMP_ACT_LOG"
-  targetWorkload: "example-profiles"
+  targetWorkload: "generic"
 ---
 apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
 kind: SeccompProfile
 metadata:
-  name: profile-allow
+  name: profile-allow-unsafe
+  annotations:
+    description: "UNSAFE: Allows all syscalls. Similar to running as unconfined as it provides no enforcement."
 spec:
   defaultAction: "SCMP_ACT_ALLOW"
-  targetWorkload: "example-profiles"
+  targetWorkload: "generic"
+---
+apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
+kind: SeccompProfile
+metadata:
+  name: profile-complain-block-high-risk
+  annotations:
+    description: "Enables complain mode whilst blocking high-risk syscalls. Some essential syscalls are allowed to decrease log noise."
+spec:
+  defaultAction: SCMP_ACT_LOG
+  targetWorkload: "generic"
+  architectures:
+  - SCMP_ARCH_X86_64
+  syscalls:
+  - action: SCMP_ACT_ALLOW
+    names:
+    - exit
+    - exit_group
+    - futex
+    - nanosleep
+
+  - action: SCMP_ACT_ERRNO
+    names:
+    - acct
+    - add_key
+    - bpf
+    - clock_adjtime
+    - clock_settime
+    - create_module
+    - delete_module
+    - finit_module
+    - get_kernel_syms
+    - get_mempolicy
+    - init_module
+    - ioperm
+    - iopl
+    - kcmp
+    - kexec_file_load
+    - kexec_load
+    - keyctl
+    - lookup_dcookie
+    - mbind
+    - mount
+    - move_pages
+    - name_to_handle_at
+    - nfsservctl
+    - open_by_handle_at
+    - perf_event_open
+    - personality
+    - pivot_root
+    - process_vm_readv
+    - process_vm_writev
+    - ptrace
+    - query_module
+    - quotactl
+    - reboot
+    - request_key
+    - set_mempolicy
+    - setns
+    - settimeofday
+    - stime
+    - swapoff
+    - swapon
+    - _sysctl
+    - sysfs
+    - umount2
+    - umount
+    - unshare
+    - uselib
+    - userfaultfd
+    - ustat
+    - vm86old
+    - vm86
diff --git a/installation-usage.md b/installation-usage.md
index cf1fe33bf..6d0154dc4 100644
--- a/installation-usage.md
+++ b/installation-usage.md
@@ -177,7 +177,7 @@ name matches the binding:
 
 ```sh
 $ kubectl get pod test-pod -o jsonpath='{.spec.containers[*].securityContext.seccompProfile}'
-{"localhostProfile":"operator/default/example-profiles/profile-complain.json","type":"Localhost"}
+{"localhostProfile":"operator/default/generic/profile-complain-unsafe.json","type":"Localhost"}
 ```
 
 #### Record profiles from workloads with ProfileRecordings
diff --git a/internal/pkg/controllers/spod/configmap_controller.go b/internal/pkg/controllers/spod/configmap_controller.go
index ecbdbd8a5..b7cab071f 100644
--- a/internal/pkg/controllers/spod/configmap_controller.go
+++ b/internal/pkg/controllers/spod/configmap_controller.go
@@ -18,11 +18,11 @@ package spod
 
 import (
 	"context"
-	"fmt"
 	"strconv"
 
 	"github.com/crossplane/crossplane-runtime/pkg/event"
 	"github.com/go-logr/logr"
+	"github.com/pkg/errors"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	kerrors "k8s.io/apimachinery/pkg/api/errors"
@@ -59,18 +59,18 @@ func (r *ReconcileSPOd) Reconcile(request reconcile.Request) (reconcile.Result,
 		if kerrors.IsNotFound(err) {
 			return reconcile.Result{}, nil
 		}
-		return reconcile.Result{}, fmt.Errorf("error getting spod configuration: %w", err)
+		return reconcile.Result{}, errors.Wrap(err, "getting spod configuration")
 	}
 	spodKey := types.NamespacedName{
 		Name:      r.baseSPOd.GetName(),
 		Namespace: config.GetOperatorNamespace(),
 	}
 	foundSPOd := &appsv1.DaemonSet{}
-	if getErr := r.client.Get(ctx, spodKey, foundSPOd); getErr != nil {
-		if kerrors.IsNotFound(getErr) {
+	if err := r.client.Get(ctx, spodKey, foundSPOd); err != nil {
+		if kerrors.IsNotFound(err) {
 			return r.handleCreate(ctx, cminstance)
 		}
-		return reconcile.Result{}, fmt.Errorf("error getting spod DaemonSet: %w", getErr)
+		return reconcile.Result{}, errors.Wrap(err, "getting spod DaemonSet")
 	}
 
 	// NOTE(jaosorior): We gotta handle updates
@@ -82,14 +82,14 @@ func (r *ReconcileSPOd) handleCreate(ctx context.Context, cfg *corev1.ConfigMap)
 	newSPOd := r.getConfiguredSPOd(cfg)
 
 	if err := controllerutil.SetControllerReference(cfg, newSPOd, r.scheme); err != nil {
-		return reconcile.Result{}, fmt.Errorf("error setting spod controller reference: %w", err)
+		return reconcile.Result{}, errors.Wrap(err, "setting spod controller reference")
 	}
 
-	if createErr := r.client.Create(ctx, newSPOd); createErr != nil {
-		if kerrors.IsAlreadyExists(createErr) {
+	if err := r.client.Create(ctx, newSPOd); err != nil {
+		if kerrors.IsAlreadyExists(err) {
 			return reconcile.Result{}, nil
 		}
-		return reconcile.Result{}, fmt.Errorf("error creating spod DaemonSet: %w", createErr)
+		return reconcile.Result{}, errors.Wrap(err, "error creating spod DaemonSet")
 	}
 	return reconcile.Result{}, nil
 }


Test patch:
diff --git a/test/e2e_test.go b/test/e2e_test.go
index 12113c7cc..046028277 100644
--- a/test/e2e_test.go
+++ b/test/e2e_test.go
@@ -77,10 +77,6 @@ func (e *e2e) TestSecurityProfilesOperator() {
 			"Seccomp: Re-deploy the operator",
 			e.testCaseReDeployOperator,
 		},
-		{
-			"Seccomp: Verify profile binding",
-			e.testCaseProfileBinding,
-		},
 		{
 			"SELinux: sanity check",
 			e.testCaseSelinuxSanityCheck,
@@ -91,10 +87,18 @@ func (e *e2e) TestSecurityProfilesOperator() {
 		},
 	}
 	for _, testCase := range testCases {
-		e.logf("> Running testcase: %s", testCase.description)
-		testCase.fn(nodes)
+		tc := testCase
+		e.Run("cluster-wide: "+tc.description, func() {
+			tc.fn(nodes)
+		})
 	}
 
+	// TODO(jaosorior): Re-introduce this to the namespaced tests once we
+	// fix the issue with the certs.
+	e.Run("cluster-wide: Seccomp: Verify profile binding", func() {
+		e.testCaseProfileBinding(nodes)
+	})
+
 	// Clean up cluster-wide deployment to prepare for namespace deployment
 	e.cleanupOperator(manifest, defaultProfiles)
 
@@ -120,8 +124,10 @@ func (e *e2e) TestSecurityProfilesOperator() {
 	e.deployOperator(namespaceManifest, namespaceDefaultProfiles)
 
 	for _, testCase := range testCases {
-		e.logf("> Running testcase: %s", testCase.description)
-		testCase.fn(nodes)
+		tc := testCase
+		e.Run("namespaced: "+tc.description, func() {
+			tc.fn(nodes)
+		})
 	}
 }
 
diff --git a/test/suite_test.go b/test/suite_test.go
index afab21b3e..1ecef631a 100644
--- a/test/suite_test.go
+++ b/test/suite_test.go
@@ -69,8 +69,11 @@ type openShifte2e struct {
 	skipBuildImages bool
 }
 
+// We're unable to use parallel tests because of our usage of testify/suite.
+// See https://github.com/stretchr/testify/issues/187
+//
+// nolint:paralleltest
 func TestSuite(t *testing.T) {
-	t.Parallel()
 	fmt.Printf("cluster-type: %s\n", clusterType)
 	fmt.Printf("container-runtime: %s\n", containerRuntime)
 
diff --git a/test/tc_default_profiles_test.go b/test/tc_default_profiles_test.go
index 909d321e0..aae4f6e0b 100644
--- a/test/tc_default_profiles_test.go
+++ b/test/tc_default_profiles_test.go
@@ -29,7 +29,7 @@ import (
 
 func (e *e2e) testCaseDefaultAndExampleProfiles(nodes []string) {
 	const exampleProfilePath = "examples/seccompprofile.yaml"
-	exampleProfileNames := [3]string{"profile-allow", "profile-complain", "profile-block"}
+	exampleProfileNames := [3]string{"profile-allow-unsafe", "profile-complain-unsafe", "profile-block-all"}
 	defaultProfileNames := [1]string{"nginx-1.19.1"}
 	e.kubectl("create", "-f", exampleProfilePath)
 	defer e.kubectl("delete", "-f", exampleProfilePath)
diff --git a/test/tc_profilebindings_test.go b/test/tc_profilebindings_test.go
index 6a2c4a50f..890dbdc34 100644
--- a/test/tc_profilebindings_test.go
+++ b/test/tc_profilebindings_test.go
@@ -33,7 +33,7 @@ metadata:
 spec:
   profileRef:
     kind: SeccompProfile
-    name: profile-allow
+    name: profile-allow-unsafe
   image: hello-world
 `
 	const testPod = `
@@ -103,7 +103,7 @@ spec:
 		"get", "pod", "hello",
 		"--output", "jsonpath={.spec.containers[0].securityContext.seccompProfile.localhostProfile}",
 	)
-	e.Equal(fmt.Sprintf("operator/%s/example-profiles/profile-allow.json", namespace), output)
+	e.Equal(fmt.Sprintf("operator/%s/generic/profile-allow-unsafe.json", namespace), output)
 
 	e.logf("Testing that profile binding has pod reference")
 	output = e.kubectl("get", "profilebinding", "hello-binding", "--output", "jsonpath={.status.activeWorkloads[0]}")
@@ -112,9 +112,13 @@ spec:
 	e.Equal("active-workload-lock", output)
 
 	e.logf("Testing that profile has pod reference")
-	output = e.kubectl("get", "seccompprofile", "profile-allow", "--output", "jsonpath={.status.activeWorkloads[0]}")
+	output = e.kubectl("get", "seccompprofile", "profile-allow-unsafe",
+		"--output", "jsonpath={.status.activeWorkloads[0]}")
+
 	e.Equal(fmt.Sprintf("%s/hello", namespace), output)
-	output = e.kubectl("get", "seccompprofile", "profile-allow", "--output", "jsonpath={.metadata.finalizers}")
+	output = e.kubectl("get", "seccompprofile", "profile-allow-unsafe",
+		"--output", "jsonpath={.metadata.finalizers}")
+
 	e.Contains(output, "in-use-by-active-pods")
 }