Repository: tektoncd/operator
Pull request #1612 (2023-07-12 14:42:56)

Remove seccompprofile from containers
This is to remove seccompprofile from containers also and reverting operator deployment change done wrong in previous commit

# Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

- [ ] Run `make test lint` before submitting a PR
- [ ] Includes [tests](https://github.com/tektoncd/community/blob/master/standards.md#principles) (if functionality changed/added)
- [ ] Includes [docs](https://github.com/tektoncd/community/blob/master/standards.md#principles) (if user facing)
- [ ] Commit messages follow [commit message best practices](https://github.com/tektoncd/community/blob/master/standards.md#commit-messages)

_See [the contribution guide](https://github.com/tektoncd/operator/blob/master/CONTRIBUTING.md) for more details._

# Release Notes

```release-note
Remove seccompprofile from containers
```

tekton-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by:
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please ask for approval from **piyush-garg** after the PR has been reviewed.

The full list of commands accepted by this bot can be found [here](https://prow.tekton.dev/command-help?repo=tektoncd%2Foperator).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/tektoncd/operator/blob/release-v0.63.x/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["piyush-garg"]} -->

Patch:
diff --git a/config/openshift/base/operator.yaml b/config/openshift/base/operator.yaml
index b2807b10b..0e01315be 100644
--- a/config/openshift/base/operator.yaml
+++ b/config/openshift/base/operator.yaml
@@ -30,6 +30,8 @@ spec:
     spec:
       securityContext:
         runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: openshift-pipelines-operator
       containers:
       - name: openshift-pipelines-operator-lifecycle  # all reconcilers except tektoninstallerset reconciler
diff --git a/config/openshift/base/webhook.yaml b/config/openshift/base/webhook.yaml
index 25d6cc3f4..ef0d11f05 100644
--- a/config/openshift/base/webhook.yaml
+++ b/config/openshift/base/webhook.yaml
@@ -32,6 +32,8 @@ spec:
     spec:
       securityContext:
         runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: openshift-pipelines-operator
       containers:
       - name: tekton-operator-webhook
diff --git a/pkg/reconciler/common/transformers.go b/pkg/reconciler/common/transformers.go
index 4527a6213..752e557d0 100644
--- a/pkg/reconciler/common/transformers.go
+++ b/pkg/reconciler/common/transformers.go
@@ -630,6 +630,9 @@ func AddDeploymentRestrictedPSA() mf.Transformer {
 			}
 			c.SecurityContext.AllowPrivilegeEscalation = ptr.Bool(allowPrivilegedEscalationValue)
 			c.SecurityContext.Capabilities = &corev1.Capabilities{Drop: []corev1.Capability{"ALL"}}
+			if c.SecurityContext.SeccompProfile != nil {
+				c.SecurityContext.SeccompProfile = nil
+			}
 		}
 
 		unstrObj, err := runtime.DefaultUnstructuredConverter.ToUnstructured(d)
@@ -673,6 +676,9 @@ func AddStatefulSetRestrictedPSA() mf.Transformer {
 			}
 			c.SecurityContext.AllowPrivilegeEscalation = ptr.Bool(allowPrivilegedEscalationValue)
 			c.SecurityContext.Capabilities = &corev1.Capabilities{Drop: []corev1.Capability{"ALL"}}
+			if c.SecurityContext.SeccompProfile != nil {
+				c.SecurityContext.SeccompProfile = nil
+			}
 		}
 
 		unstrObj, err := runtime.DefaultUnstructuredConverter.ToUnstructured(s)
@@ -720,6 +726,9 @@ func AddJobRestrictedPSA() mf.Transformer {
 			if c.SecurityContext.Capabilities == nil {
 				c.SecurityContext.Capabilities = &corev1.Capabilities{Drop: []corev1.Capability{"ALL"}}
 			}
+			if c.SecurityContext.SeccompProfile != nil {
+				c.SecurityContext.SeccompProfile = nil
+			}
 		}
 		unstrObj, err := runtime.DefaultUnstructuredConverter.ToUnstructured(jb)
 		if err != nil {


Test patch:
diff --git a/pkg/reconciler/common/testdata/test-add-psa.yaml b/pkg/reconciler/common/testdata/test-add-psa.yaml
index 480f29d19..96ef26b0d 100644
--- a/pkg/reconciler/common/testdata/test-add-psa.yaml
+++ b/pkg/reconciler/common/testdata/test-add-psa.yaml
@@ -47,3 +47,6 @@ spec:
           ports:
             - containerPort: 8000
             - containerPort: 4200
+          securityContext:
+            seccompProfile:
+              type: RuntimeDefault