Description

Currently acceptance tests run against Kind are failing as seen on the previous run here. I ran them on my fork as well with the following setups and both failed:

• Failed run: Kind 0.17 + Terraform 1.4.0
• Failed run: Kind 0.20 + Terraform 1.5.1

Two issues here:

• On k8s 1.25 an empty localhost seccomp profile is a no-op but errors on k8s 1.27 with Error: localhostProfile must be set if seccompProfile type is Localhost. Fixing it for 1.27 only makes it better for 1.25.
• Pod backoff limit is 6 by default (see docs) not 0, which is why tests fail on both 1.25 and 1.27. This is one of the reasons why AKS acceptance tests (see example run) are failing as well.

This PR addresses the issues as follows:

• Add a sample audit seccomp profile to .github/config/seccomp-profiles as documented on k8s docs. Happy to hear input if this is the right place to store these.
• Add a custom deployment configuration in .github/config for Kind, in which the seccomp profiles directory is mounted upon cluster creation.
• Use custom config in Kind GHA.
• Add methods for identifying whether a test is run against a Kind cluster. Similar methods exist for GKE, AKS, Minikube and the like already.
• Spin-off separate test for seccomp tests which require node-local seccomp policies. Run it only on Kind. Maybe this can be extended to cover other clusters as well, but I don't have any test clusters on those platforms.
• Change pod backoff limit default expectations to match documentation.

Acceptance tests

• Have you added an acceptance test for the functionality being added?
• Have you run the acceptance tests on this branch?

Output from acceptance testing:

• Successful run: Kind 0.17 (k8s 1.25) and Terraform 1.4.0
• Successful run: Kind 0.20 (k8s 1.27) and Terraform 1.5.1

Release Note

Release note for CHANGELOG:

NONE

References

None

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment