Repository: tektoncd/operator
Pull request #1609 (2023-07-12 12:42:17)

Fix psa to make this run on kubernetes 1.23

# Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

- [ ] Run `make test lint` before submitting a PR
- [ ] Includes [tests](https://github.com/tektoncd/community/blob/master/standards.md#principles) (if functionality changed/added)
- [ ] Includes [docs](https://github.com/tektoncd/community/blob/master/standards.md#principles) (if user facing)
- [ ] Commit messages follow [commit message best practices](https://github.com/tektoncd/community/blob/master/standards.md#commit-messages)

_See [the contribution guide](https://github.com/tektoncd/operator/blob/master/CONTRIBUTING.md) for more details._

# Release Notes

```release-note
Fix psa to make this run on kubernetes 1.23
```


tekton-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by:
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please ask for approval from **piyush-garg** after the PR has been reviewed.

The full list of commands accepted by this bot can be found [here](https://prow.tekton.dev/command-help?repo=tektoncd%2Foperator).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/tektoncd/operator/blob/release-v0.63.x/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["piyush-garg"]} -->
concaf: /lgtm

Patch:
diff --git a/cmd/openshift/operator/kodata/tekton-addon/addons/05-tkncliserve/tkn_cli_serve.yaml b/cmd/openshift/operator/kodata/tekton-addon/addons/05-tkncliserve/tkn_cli_serve.yaml
index f7ea74612..a60c87d0e 100644
--- a/cmd/openshift/operator/kodata/tekton-addon/addons/05-tkncliserve/tkn_cli_serve.yaml
+++ b/cmd/openshift/operator/kodata/tekton-addon/addons/05-tkncliserve/tkn_cli_serve.yaml
@@ -18,8 +18,6 @@ spec:
     spec:
       securityContext:
         runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
       containers:
         - name: tkn-cli-serve
           image: docker.io/rupali/serve-tkn:v2
diff --git a/cmd/openshift/operator/kodata/webhook/webhook.yaml b/cmd/openshift/operator/kodata/webhook/webhook.yaml
index 5e7d8935d..189004968 100644
--- a/cmd/openshift/operator/kodata/webhook/webhook.yaml
+++ b/cmd/openshift/operator/kodata/webhook/webhook.yaml
@@ -101,8 +101,6 @@ spec:
     spec:
       securityContext:
         runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
       serviceAccountName: tekton-operators-proxy-webhook
       containers:
         - name: proxy
diff --git a/config/openshift/base/operator.yaml b/config/openshift/base/operator.yaml
index 0e01315be..b2807b10b 100644
--- a/config/openshift/base/operator.yaml
+++ b/config/openshift/base/operator.yaml
@@ -30,8 +30,6 @@ spec:
     spec:
       securityContext:
         runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
       serviceAccountName: openshift-pipelines-operator
       containers:
       - name: openshift-pipelines-operator-lifecycle  # all reconcilers except tektoninstallerset reconciler
diff --git a/config/openshift/base/webhook.yaml b/config/openshift/base/webhook.yaml
index ef0d11f05..25d6cc3f4 100644
--- a/config/openshift/base/webhook.yaml
+++ b/config/openshift/base/webhook.yaml
@@ -32,8 +32,6 @@ spec:
     spec:
       securityContext:
         runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
       serviceAccountName: openshift-pipelines-operator
       containers:
       - name: tekton-operator-webhook
diff --git a/pkg/reconciler/common/prune.go b/pkg/reconciler/common/prune.go
index 517d2d89e..a810027e2 100644
--- a/pkg/reconciler/common/prune.go
+++ b/pkg/reconciler/common/prune.go
@@ -384,9 +384,6 @@ func createCronJob(ctx context.Context, kc kubernetes.Interface, cronName, targe
 							Tolerations:        tC.Spec.Config.Tolerations,
 							SecurityContext: &corev1.PodSecurityContext{
 								RunAsNonRoot: &runAsNonRoot,
-								SeccompProfile: &corev1.SeccompProfile{
-									Type: corev1.SeccompProfileTypeRuntimeDefault,
-								},
 							},
 						},
 					},
diff --git a/pkg/reconciler/common/transformers.go b/pkg/reconciler/common/transformers.go
index 86f42ee42..4527a6213 100644
--- a/pkg/reconciler/common/transformers.go
+++ b/pkg/reconciler/common/transformers.go
@@ -619,10 +619,8 @@ func AddDeploymentRestrictedPSA() mf.Transformer {
 			d.Spec.Template.Spec.SecurityContext.RunAsNonRoot = ptr.Bool(runAsNonRootValue)
 		}
 
-		if d.Spec.Template.Spec.SecurityContext.SeccompProfile == nil {
-			d.Spec.Template.Spec.SecurityContext.SeccompProfile = &corev1.SeccompProfile{
-				Type: corev1.SeccompProfileTypeRuntimeDefault,
-			}
+		if d.Spec.Template.Spec.SecurityContext.SeccompProfile != nil {
+			d.Spec.Template.Spec.SecurityContext.SeccompProfile = nil
 		}
 
 		for i := range d.Spec.Template.Spec.Containers {
@@ -664,10 +662,8 @@ func AddStatefulSetRestrictedPSA() mf.Transformer {
 			s.Spec.Template.Spec.SecurityContext.RunAsNonRoot = ptr.Bool(runAsNonRootValue)
 		}
 
-		if s.Spec.Template.Spec.SecurityContext.SeccompProfile == nil {
-			s.Spec.Template.Spec.SecurityContext.SeccompProfile = &corev1.SeccompProfile{
-				Type: corev1.SeccompProfileTypeRuntimeDefault,
-			}
+		if s.Spec.Template.Spec.SecurityContext.SeccompProfile != nil {
+			s.Spec.Template.Spec.SecurityContext.SeccompProfile = nil
 		}
 
 		for i := range s.Spec.Template.Spec.Containers {
@@ -709,10 +705,8 @@ func AddJobRestrictedPSA() mf.Transformer {
 			jb.Spec.Template.Spec.SecurityContext.RunAsNonRoot = ptr.Bool(runAsNonRootValue)
 		}
 
-		if jb.Spec.Template.Spec.SecurityContext.SeccompProfile == nil {
-			jb.Spec.Template.Spec.SecurityContext.SeccompProfile = &corev1.SeccompProfile{
-				Type: corev1.SeccompProfileTypeRuntimeDefault,
-			}
+		if jb.Spec.Template.Spec.SecurityContext.SeccompProfile != nil {
+			jb.Spec.Template.Spec.SecurityContext.SeccompProfile = nil
 		}
 
 		for i := range jb.Spec.Template.Spec.Containers {


Test patch:
diff --git a/pkg/reconciler/common/testdata/test-add-psa-expected-statefulset.yaml b/pkg/reconciler/common/testdata/test-add-psa-expected-statefulset.yaml
index 7c1baf91e..3f6207bd6 100644
--- a/pkg/reconciler/common/testdata/test-add-psa-expected-statefulset.yaml
+++ b/pkg/reconciler/common/testdata/test-add-psa-expected-statefulset.yaml
@@ -24,8 +24,6 @@ spec:
     spec:
       securityContext:
         runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
       containers:
         - envFrom:
             - configMapRef:
diff --git a/pkg/reconciler/common/testdata/test-add-psa-expected.yaml b/pkg/reconciler/common/testdata/test-add-psa-expected.yaml
index 01a289c24..2f24f46f6 100644
--- a/pkg/reconciler/common/testdata/test-add-psa-expected.yaml
+++ b/pkg/reconciler/common/testdata/test-add-psa-expected.yaml
@@ -30,8 +30,6 @@ spec:
     spec:
       securityContext:
         runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
       volumes:
         - name: catalog-source
           persistentVolumeClaim: