Repository: kubernetes-sigs/security-profiles-operator
Pull request #1178 (2022-09-20 02:42:27)

BUG 2082099: Fix finalizer string too long
/kind bug

#### What this PR does / why we need it:

This PR shorten the finalizer string if it is over the limit size of 63

#### Does this PR have test?

Yes

#### Does this PR introduce a user-facing change?
No

```release-note
Fix the finalizer string too long, shorten the length of the node name if the finalizer string combined length is over the size of 63
```

####Which issue(s) this PR fixes:

Fixes: [BZ 2082099](https://bugzilla.redhat.com/show_bug.cgi?id=2082099)




k8s-ci-robot: @Vincent056: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our [release note process](https://git.k8s.io/community/contributors/guide/release-notes.md) to remove it.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
k8s-ci-robot: Hi @Vincent056. Thanks for your PR.

I'm waiting for a [kubernetes-sigs](https://github.com/orgs/kubernetes-sigs/people) member to verify that this patch is reasonable to test. If it is, they should reply with `/ok-to-test` on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should [join the org](https://git.k8s.io/community/community-membership.md#member) to skip this step.

Once the patch is verified, the new status will be reflected by the `ok-to-test` label.

I understand the commands that are listed [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>

k8s-ci-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1178#" title="Author self-approved">Vincent056</a>*
**Once this PR has been reviewed and has the lgtm label**, please assign pjbgf for approval by writing `/assign @pjbgf` in a comment. For more information see:[The Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["pjbgf"]} -->
saschagrunert: /ok-to-test

Thank you for the fix @Vincent056! 
k8s-ci-robot: @Vincent056: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | 3f27522ade4bf1aa19761ea40bdca6298caeaf64 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1178/pull-security-profiles-operator-verify/1572119860794626048) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1178). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AVincent056). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
jhrozek: An e2e test would also be nice.
k8s-ci-robot: @Vincent056: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | 924e0aedd4a428b43f508039777ccbf8c9a59453 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1178/pull-security-profiles-operator-verify/1572398177535922176) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1178). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AVincent056). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
jhrozek: ```
internal/pkg/nodestatus/nodestatus_test.go:23: File is not `gci`-ed with --skip-generated -s standard,default,prefix(sigs.k8s.io/security-profiles-operator) (gci)
	"github.com/stretchr/testify/require"
```

So far I've had the best results with fixing the gci issues by running gci manually, something like:
```
go install github.com/daixiang0/gci@latest
gci write path/to/file
```
There is also the `-l` option that allows you to specify "local" imports that should be sorted last, but I could never get the flag combination to work, so I sort them manually. Normally the SPO expects the imports to be sorted:

- stdlib, alphabetically
- third party, alphabetically
- local, alphabetically

```
internal/pkg/nodestatus/nodestatus_test.go:60: File is not `gofumpt`-ed (gofumpt)
```

`/build/golangci-lint run --fix --build-tags no_bpf` should do the trick

Don't forget to remove and reinstall golangci-lint if you have an old version locally.
k8s-ci-robot: @Vincent056: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | 766162f48ae00d33e9569ddc1d9592f87324e2ee | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1178/pull-security-profiles-operator-verify/1572783601097904128) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1178). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AVincent056). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @Vincent056: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | 08106591e97c1b618179354859c4cc6292e7ba76 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1178/pull-security-profiles-operator-verify/1572788083923881984) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1178). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AVincent056). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
Vincent056: @jhrozek It seems like `t.Parallel called after t.Setenv; cannot set environment variables in parallel tests [recovered]`, and not setting parallel is causing verify to fail
jhrozek: > @jhrozek It seems like `t.Parallel called after t.Setenv; cannot set environment variables in parallel tests [recovered]`, and not setting parallel is causing verify to fail

Can you try adding `//nolint:paralleltest` with the explanation you used to suppress the warning? There are some other uses of this stanza in SPO, you can git grep for its usage to see exactly where and how it's used.

k8s-ci-robot: @Vincent056: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | 390f407ce823bf2847e28919a8dca2480c76e838 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1178/pull-security-profiles-operator-verify/1573043216024866816) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1178). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AVincent056). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @Vincent056: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | 8c491ab031b8525fd3e906e784b1208eb5996c80 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1178/pull-security-profiles-operator-verify/1573046199798206464) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1178). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3AVincent056). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->

Patch:
diff --git a/bundle/manifests/security-profiles-operator-profile_v1_configmap.yaml b/bundle/manifests/security-profiles-operator-profile_v1_configmap.yaml
index 3033b0e73..8849659e5 100644
--- a/bundle/manifests/security-profiles-operator-profile_v1_configmap.yaml
+++ b/bundle/manifests/security-profiles-operator-profile_v1_configmap.yaml
@@ -8,6 +8,7 @@ data:
         {
           "names": [
             "accept4",
+            "access",
             "arch_prctl",
             "bind",
             "brk",
diff --git a/deploy/base/profiles/security-profiles-operator.json b/deploy/base/profiles/security-profiles-operator.json
index 0901b4253..c40ef0732 100644
--- a/deploy/base/profiles/security-profiles-operator.json
+++ b/deploy/base/profiles/security-profiles-operator.json
@@ -5,6 +5,7 @@
     {
       "names": [
         "accept4",
+        "access",
         "arch_prctl",
         "bind",
         "brk",
diff --git a/deploy/helm/templates/static-resources.yaml b/deploy/helm/templates/static-resources.yaml
index 15cdec826..5b1090370 100644
--- a/deploy/helm/templates/static-resources.yaml
+++ b/deploy/helm/templates/static-resources.yaml
@@ -755,6 +755,7 @@ data:
         {
           "names": [
             "accept4",
+            "access",
             "arch_prctl",
             "bind",
             "brk",
diff --git a/deploy/namespace-operator.yaml b/deploy/namespace-operator.yaml
index 67ef72408..d287f9f5e 100644
--- a/deploy/namespace-operator.yaml
+++ b/deploy/namespace-operator.yaml
@@ -1832,6 +1832,7 @@ data:
         {
           "names": [
             "accept4",
+            "access",
             "arch_prctl",
             "bind",
             "brk",
diff --git a/deploy/openshift-dev.yaml b/deploy/openshift-dev.yaml
index c0712ef9f..bb07fa49d 100644
--- a/deploy/openshift-dev.yaml
+++ b/deploy/openshift-dev.yaml
@@ -1832,6 +1832,7 @@ data:
         {
           "names": [
             "accept4",
+            "access",
             "arch_prctl",
             "bind",
             "brk",
diff --git a/deploy/operator.yaml b/deploy/operator.yaml
index c3c789730..a7876003e 100644
--- a/deploy/operator.yaml
+++ b/deploy/operator.yaml
@@ -1832,6 +1832,7 @@ data:
         {
           "names": [
             "accept4",
+            "access",
             "arch_prctl",
             "bind",
             "brk",
diff --git a/deploy/webhook-operator.yaml b/deploy/webhook-operator.yaml
index 0c3649931..9ea4ec2b6 100644
--- a/deploy/webhook-operator.yaml
+++ b/deploy/webhook-operator.yaml
@@ -1803,6 +1803,7 @@ data:
         {
           "names": [
             "accept4",
+            "access",
             "arch_prctl",
             "bind",
             "brk",
diff --git a/go.mod b/go.mod
index 67cdabafb..594d6156d 100644
--- a/go.mod
+++ b/go.mod
@@ -8,7 +8,7 @@ require (
 	github.com/blang/semver/v4 v4.0.0
 	github.com/cert-manager/cert-manager v1.9.1
 	github.com/containers/common v0.48.1-0.20220510094751-400832f41771
-	github.com/crossplane/crossplane-runtime v0.17.0
+	github.com/crossplane/crossplane-runtime v0.18.0
 	github.com/go-logr/logr v1.2.3
 	github.com/jellydator/ttlcache/v3 v3.0.0
 	github.com/maxbrunsfeld/counterfeiter/v6 v6.5.0
@@ -27,9 +27,9 @@ require (
 	google.golang.org/grpc v1.49.0
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.2.0
 	google.golang.org/protobuf v1.28.1
-	k8s.io/api v0.25.1
-	k8s.io/apimachinery v0.25.1
-	k8s.io/client-go v0.25.1
+	k8s.io/api v0.25.2
+	k8s.io/apimachinery v0.25.2
+	k8s.io/client-go v0.25.2
 	k8s.io/klog/v2 v2.80.1
 	sigs.k8s.io/controller-runtime v0.12.3
 	sigs.k8s.io/controller-tools v0.9.2
diff --git a/go.sum b/go.sum
index 73a7c39fc..5083c51fe 100644
--- a/go.sum
+++ b/go.sum
@@ -387,8 +387,8 @@ github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7Do
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/creack/pty v1.1.11 h1:07n33Z8lZxZ2qwegKbObQohDhXDQxiMMz1NOUGYlesw=
 github.com/creack/pty v1.1.11/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/crossplane/crossplane-runtime v0.17.0 h1:gt2JcOYcVBw/luQToq2hUkoersL12ICuV0YzKI5lyCs=
-github.com/crossplane/crossplane-runtime v0.17.0/go.mod h1:IPT3HTsovwmbw3i+SdsOyaC3r3b7TW+otBMmZsHLnSU=
+github.com/crossplane/crossplane-runtime v0.18.0 h1:j1VxhKWp3iQKr1XNiMoBKmEvN2Z98E7rR0tyimu7dj4=
+github.com/crossplane/crossplane-runtime v0.18.0/go.mod h1:o9ExoilV6k2M3qzSFoRVX4phuww0mLmjs1WrDTvsR4s=
 github.com/cyphar/filepath-securejoin v0.2.2/go.mod h1:FpkQEhXnPnOthhzymB7CGsFk2G9VLXONKD9G7QGMM+4=
 github.com/cyphar/filepath-securejoin v0.2.3/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
 github.com/d2g/dhcp4 v0.0.0-20170904100407-a1d1b6c41b1c/go.mod h1:Ct2BUK8SB0YC1SMSibvLzxjeJLnrYEVLULFNiHY9YfQ=
@@ -2165,8 +2165,8 @@ k8s.io/api v0.22.1/go.mod h1:bh13rkTp3F1XEaLGykbyRD2QaTTzPm0e/BMd8ptFONY=
 k8s.io/api v0.22.5/go.mod h1:mEhXyLaSD1qTOf40rRiKXkc+2iCem09rWLlFwhCEiAs=
 k8s.io/api v0.23.0/go.mod h1:8wmDdLBHBNxtOIytwLstXt5E9PddnZb0GaMcqsvDBpg=
 k8s.io/api v0.24.2/go.mod h1:AHqbSkTm6YrQ0ObxjO3Pmp/ubFF/KuM7jU+3khoBsOg=
-k8s.io/api v0.25.1 h1:yL7du50yc93k17nH/Xe9jujAYrcDkI/i5DL1jPz4E3M=
-k8s.io/api v0.25.1/go.mod h1:hh4itDvrWSJsmeUc28rIFNri8MatNAAxJjKcQmhX6TU=
+k8s.io/api v0.25.2 h1:v6G8RyFcwf0HR5jQGIAYlvtRNrxMJQG1xJzaSeVnIS8=
+k8s.io/api v0.25.2/go.mod h1:qP1Rn4sCVFwx/xIhe+we2cwBLTXNcheRyYXwajonhy0=
 k8s.io/apiextensions-apiserver v0.21.3/go.mod h1:kl6dap3Gd45+21Jnh6utCx8Z2xxLm8LGDkprcd+KbsE=
 k8s.io/apiextensions-apiserver v0.25.0 h1:CJ9zlyXAbq0FIW8CD7HHyozCMBpDSiH7EdrSTCZcZFY=
 k8s.io/apiextensions-apiserver v0.25.0/go.mod h1:3pAjZiN4zw7R8aZC5gR0y3/vCkGlAjCazcg1me8iB/E=
@@ -2178,8 +2178,8 @@ k8s.io/apimachinery v0.22.1/go.mod h1:O3oNtNadZdeOMxHFVxOreoznohCpy0z6mocxbZr7oJ
 k8s.io/apimachinery v0.22.5/go.mod h1:xziclGKwuuJ2RM5/rSFQSYAj0zdbci3DH8kj+WvyN0U=
 k8s.io/apimachinery v0.23.0/go.mod h1:fFCTTBKvKcwTPFzjlcxp91uPFZr+JA0FubU4fLzzFYc=
 k8s.io/apimachinery v0.24.2/go.mod h1:82Bi4sCzVBdpYjyI4jY6aHX+YCUchUIrZrXKedjd2UM=
-k8s.io/apimachinery v0.25.1 h1:t0XrnmCEHVgJlR2arwO8Awp9ylluDic706WePaYCBTI=
-k8s.io/apimachinery v0.25.1/go.mod h1:hqqA1X0bsgsxI6dXsJ4HnNTBOmJNxyPp8dw3u2fSHwA=
+k8s.io/apimachinery v0.25.2 h1:WbxfAjCx+AeN8Ilp9joWnyJ6xu9OMeS/fsfjK/5zaQs=
+k8s.io/apimachinery v0.25.2/go.mod h1:hqqA1X0bsgsxI6dXsJ4HnNTBOmJNxyPp8dw3u2fSHwA=
 k8s.io/apiserver v0.20.1/go.mod h1:ro5QHeQkgMS7ZGpvf4tSMx6bBOgPfE+f52KwvXfScaU=
 k8s.io/apiserver v0.20.4/go.mod h1:Mc80thBKOyy7tbvFtB4kJv1kbdD0eIH8k8vianJcbFM=
 k8s.io/apiserver v0.20.6/go.mod h1:QIJXNt6i6JB+0YQRNcS0hdRHJlMhflFmsBDeSgT1r8Q=
@@ -2194,8 +2194,8 @@ k8s.io/client-go v0.21.3/go.mod h1:+VPhCgTsaFmGILxR/7E1N0S+ryO010QBeNCv5JwRGYU=
 k8s.io/client-go v0.22.1/go.mod h1:BquC5A4UOo4qVDUtoc04/+Nxp1MeHcVc1HJm1KmG8kk=
 k8s.io/client-go v0.22.5/go.mod h1:cs6yf/61q2T1SdQL5Rdcjg9J1ElXSwbjSrW2vFImM4Y=
 k8s.io/client-go v0.24.2/go.mod h1:zg4Xaoo+umDsfCWr4fCnmLEtQXyCNXCvJuSsglNcV30=
-k8s.io/client-go v0.25.1 h1:uFj4AJKtE1/ckcSKz8IhgAuZTdRXZDKev8g387ndD58=
-k8s.io/client-go v0.25.1/go.mod h1:rdFWTLV/uj2C74zGbQzOsmXPUtMAjSf7ajil4iJUNKo=
+k8s.io/client-go v0.25.2 h1:SUPp9p5CwM0yXGQrwYurw9LWz+YtMwhWd0GqOsSiefo=
+k8s.io/client-go v0.25.2/go.mod h1:i7cNU7N+yGQmJkewcRD2+Vuj4iz7b30kI8OcL3horQ4=
 k8s.io/code-generator v0.19.7/go.mod h1:lwEq3YnLYb/7uVXLorOJfxg+cUu2oihFhHZ0n9NIla0=
 k8s.io/code-generator v0.21.3/go.mod h1:K3y0Bv9Cz2cOW2vXUrNZlFbflhuPvuadW6JdnN6gGKo=
 k8s.io/code-generator v0.22.0/go.mod h1:eV77Y09IopzeXOJzndrDyCI88UBok2h6WxAlBwpxa+o=
diff --git a/internal/pkg/nodestatus/nodestatus.go b/internal/pkg/nodestatus/nodestatus.go
index 66c4827ca..dc4d0ab01 100644
--- a/internal/pkg/nodestatus/nodestatus.go
+++ b/internal/pkg/nodestatus/nodestatus.go
@@ -33,6 +33,11 @@ import (
 	"sigs.k8s.io/security-profiles-operator/internal/pkg/util"
 )
 
+const (
+	// finalizer name length limit.
+	finalizerNameLenLimit = 63
+)
+
 type StatusClient struct {
 	pol             client.Object
 	nodeName        string
@@ -42,13 +47,18 @@ type StatusClient struct {
 
 func NewForProfile(pol client.Object, c client.Client) (*StatusClient, error) {
 	nodeName, ok := os.LookupEnv(config.NodeNameEnvKey)
+	finalizerString := nodeName + "-deleted"
 	if !ok {
 		return nil, errors.New("cannot determine node name")
 	}
+	// Make sure the length of finalizer is not longer than 63 characters
+	if len(nodeName)+len("-deleted") > finalizerNameLenLimit {
+		finalizerString = nodeName[:finalizerNameLenLimit-len("-deleted")] + "-deleted"
+	}
 	return &StatusClient{
 		pol:             pol,
 		nodeName:        nodeName,
-		finalizerString: nodeName + "-delete",
+		finalizerString: finalizerString,
 		client:          c,
 	}, nil
 }
diff --git a/vendor/github.com/crossplane/crossplane-runtime/pkg/errors/errors.go b/vendor/github.com/crossplane/crossplane-runtime/pkg/errors/errors.go
index 24cc306f5..81a95730f 100644
--- a/vendor/github.com/crossplane/crossplane-runtime/pkg/errors/errors.go
+++ b/vendor/github.com/crossplane/crossplane-runtime/pkg/errors/errors.go
@@ -52,7 +52,7 @@ func Is(err, target error) bool { return errors.Is(err, target) }
 // by repeatedly calling Unwrap.
 //
 // An error matches target if the error's concrete value is assignable to the
-// value pointed to by target, or if the error has a method As(interface{}) bool
+// value pointed to by target, or if the error has a method As(any) bool
 // such that As(target) returns true. In the latter case, the As method is
 // responsible for setting target.
 //
@@ -61,7 +61,7 @@ func Is(err, target error) bool { return errors.Is(err, target) }
 //
 // As panics if target is not a non-nil pointer to either a type that implements
 // error, or to any interface type.
-func As(err error, target interface{}) bool { return errors.As(err, target) }
+func As(err error, target any) bool { return errors.As(err, target) }
 
 // Unwrap returns the result of calling the Unwrap method on err, if err's type
 // contains an Unwrap method returning error. Otherwise, Unwrap returns nil.
@@ -75,7 +75,7 @@ func Unwrap(err error) error { return errors.Unwrap(err) }
 // invalid to include more than one %w verb or to supply it with an operand that
 // does not implement the error interface. The %w verb is otherwise a synonym
 // for %v.
-func Errorf(format string, a ...interface{}) error { return fmt.Errorf(format, a...) }
+func Errorf(format string, a ...any) error { return fmt.Errorf(format, a...) }
 
 // WithMessage annotates err with a new message. If err is nil, WithMessage
 // returns nil.
@@ -88,7 +88,7 @@ func WithMessage(err error, message string) error {
 
 // WithMessagef annotates err with the format specifier. If err is nil,
 // WithMessagef returns nil.
-func WithMessagef(err error, format string, args ...interface{}) error {
+func WithMessagef(err error, format string, args ...any) error {
 	if err == nil {
 		return nil
 	}
@@ -101,7 +101,7 @@ func Wrap(err error, message string) error {
 }
 
 // Wrapf is an alias for WithMessagef
-func Wrapf(err error, format string, args ...interface{}) error {
+func Wrapf(err error, format string, args ...any) error {
 	return WithMessagef(err, format, args...)
 }
 
diff --git a/vendor/github.com/crossplane/crossplane-runtime/pkg/resource/enqueue_handlers.go b/vendor/github.com/crossplane/crossplane-runtime/pkg/resource/enqueue_handlers.go
index 1bafa3ad9..7f74bda3d 100644
--- a/vendor/github.com/crossplane/crossplane-runtime/pkg/resource/enqueue_handlers.go
+++ b/vendor/github.com/crossplane/crossplane-runtime/pkg/resource/enqueue_handlers.go
@@ -25,7 +25,7 @@ import (
 )
 
 type adder interface {
-	Add(item interface{})
+	Add(item any)
 }
 
 // EnqueueRequestForProviderConfig enqueues a reconcile.Request for a referenced
diff --git a/vendor/github.com/crossplane/crossplane-runtime/pkg/resource/interfaces.go b/vendor/github.com/crossplane/crossplane-runtime/pkg/resource/interfaces.go
index fa3cd1d9e..01c1ee34c 100644
--- a/vendor/github.com/crossplane/crossplane-runtime/pkg/resource/interfaces.go
+++ b/vendor/github.com/crossplane/crossplane-runtime/pkg/resource/interfaces.go
@@ -142,6 +142,12 @@ type CompositeResourceReferencer interface {
 	GetResourceReference() *corev1.ObjectReference
 }
 
+// An EnvironmentConfigReferencer references a list of EnvironmentConfigs.
+type EnvironmentConfigReferencer interface {
+	SetEnvironmentConfigReferences([]corev1.ObjectReference)
+	GetEnvironmentConfigReferences() []corev1.ObjectReference
+}
+
 // A UserCounter can count how many users it has.
 type UserCounter interface {
 	SetUsers(i int64)
@@ -216,6 +222,7 @@ type Composite interface {
 	CompositionUpdater
 	CompositionRevisionReferencer
 	ComposedResourcesReferencer
+	EnvironmentConfigReferencer
 	ClaimReferencer
 	ConnectionSecretWriterTo
 	ConnectionDetailsPublisherTo
diff --git a/vendor/github.com/crossplane/crossplane-runtime/pkg/resource/providerconfig.go b/vendor/github.com/crossplane/crossplane-runtime/pkg/resource/providerconfig.go
index 5f15978dc..142cebbca 100644
--- a/vendor/github.com/crossplane/crossplane-runtime/pkg/resource/providerconfig.go
+++ b/vendor/github.com/crossplane/crossplane-runtime/pkg/resource/providerconfig.go
@@ -49,7 +49,7 @@ func (m errMissingRef) MissingReference() bool { return true }
 // IsMissingReference returns true if an error indicates that a managed
 // resource is missing a required reference..
 func IsMissingReference(err error) bool {
-	_, ok := err.(interface {
+	_, ok := err.(interface { //nolint: errorlint // Skip errorlint for interface type
 		MissingReference() bool
 	})
 	return ok
diff --git a/vendor/github.com/crossplane/crossplane-runtime/pkg/resource/resource.go b/vendor/github.com/crossplane/crossplane-runtime/pkg/resource/resource.go
index 4b35e1c89..82ff908ff 100644
--- a/vendor/github.com/crossplane/crossplane-runtime/pkg/resource/resource.go
+++ b/vendor/github.com/crossplane/crossplane-runtime/pkg/resource/resource.go
@@ -210,7 +210,7 @@ func IgnoreNotFound(err error) error {
 
 // IsAPIError returns true if the given error's type is of Kubernetes API error.
 func IsAPIError(err error) bool {
-	_, ok := err.(kerrors.APIStatus)
+	_, ok := err.(kerrors.APIStatus) //nolint: errorlint // we assert against the kerrors.APIStatus Interface which does not implement the error interface
 	return ok
 }
 
@@ -300,7 +300,7 @@ func (e errNotControllable) NotControllable() bool {
 // resource is not controllable - i.e. that it another resource is not and may
 // not become its controller reference.
 func IsNotControllable(err error) bool {
-	_, ok := err.(interface {
+	_, ok := err.(interface { //nolint: errorlint // Skip errorlint for interface type
 		NotControllable() bool
 	})
 	return ok
@@ -370,7 +370,7 @@ func NewNotAllowed(message string) error {
 // IsNotAllowed returns true if the supplied error indicates that an operation
 // was not allowed.
 func IsNotAllowed(err error) bool {
-	_, ok := err.(interface {
+	_, ok := err.(interface { //nolint: errorlint // Skip errorlint for interface type
 		NotAllowed() bool
 	})
 	return ok
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 875aecc21..b1ff97467 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -134,8 +134,8 @@ github.com/containers/common/pkg/seccomp
 # github.com/cpuguy83/go-md2man/v2 v2.0.2
 ## explicit; go 1.11
 github.com/cpuguy83/go-md2man/v2/md2man
-# github.com/crossplane/crossplane-runtime v0.17.0
-## explicit; go 1.17
+# github.com/crossplane/crossplane-runtime v0.18.0
+## explicit; go 1.18
 github.com/crossplane/crossplane-runtime/apis/common/v1
 github.com/crossplane/crossplane-runtime/pkg/errors
 github.com/crossplane/crossplane-runtime/pkg/event
@@ -827,7 +827,7 @@ helm.sh/helm/v3/pkg/plugin
 helm.sh/helm/v3/pkg/provenance
 helm.sh/helm/v3/pkg/registry
 helm.sh/helm/v3/pkg/repo
-# k8s.io/api v0.25.1
+# k8s.io/api v0.25.2
 ## explicit; go 1.19
 k8s.io/api/admission/v1
 k8s.io/api/admission/v1beta1
@@ -882,7 +882,7 @@ k8s.io/api/storage/v1beta1
 k8s.io/apiextensions-apiserver/pkg/apis/apiextensions
 k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1
 k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1
-# k8s.io/apimachinery v0.25.1
+# k8s.io/apimachinery v0.25.2
 ## explicit; go 1.19
 k8s.io/apimachinery/pkg/api/equality
 k8s.io/apimachinery/pkg/api/errors
@@ -937,7 +937,7 @@ k8s.io/apimachinery/third_party/forked/golang/reflect
 k8s.io/cli-runtime/pkg/genericclioptions
 k8s.io/cli-runtime/pkg/printers
 k8s.io/cli-runtime/pkg/resource
-# k8s.io/client-go v0.25.1
+# k8s.io/client-go v0.25.2
 ## explicit; go 1.19
 k8s.io/client-go/applyconfigurations/admissionregistration/v1
 k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1


Test patch:
diff --git a/internal/pkg/nodestatus/nodestatus_test.go b/internal/pkg/nodestatus/nodestatus_test.go
new file mode 100644
index 000000000..dbaca65f3
--- /dev/null
+++ b/internal/pkg/nodestatus/nodestatus_test.go
@@ -0,0 +1,58 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package nodestatus
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"sigs.k8s.io/security-profiles-operator/internal/pkg/config"
+)
+
+// Expected shorten the node name if length exceed the limit.
+//
+//nolint:paralleltest
+func TestShortenNodeName(t *testing.T) {
+	cases := []struct {
+		name              string
+		nodeName          string
+		wantFinalizerName string
+	}{
+		{
+			name:              "NodeNameLongerThanLimit",
+			nodeName:          "somenode-1234a-hhbhz-worker-c-xswffw.c.testlongnodename.internal",
+			wantFinalizerName: "somenode-1234a-hhbhz-worker-c-xswffw.c.testlongnodename-deleted",
+		},
+		{
+			name:              "NodeNameShorterThanLimit",
+			nodeName:          "somenode-1234a.internal",
+			wantFinalizerName: "somenode-1234a.internal-deleted",
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Setenv(config.NodeNameEnvKey, tc.nodeName)
+			sc, err := NewForProfile(nil, nil)
+			require.NoError(t, err)
+
+			require.Equal(t, tc.wantFinalizerName, sc.finalizerString)
+		})
+	}
+}