diff --git a/tests/e2e/instrumentation-go/01-add-scc.yaml b/tests/e2e/instrumentation-go/01-add-scc.yaml new file mode 100644 index 0000000000..e8a82d749e --- /dev/null +++ b/tests/e2e/instrumentation-go/01-add-scc.yaml @@ -0,0 +1,16 @@ +# Create a SA to apply the SCC policy +apiVersion: v1 +kind: ServiceAccount +metadata: + name: otel-instrumentation-go +--- +apiVersion: kuttl.dev/v1beta1 +kind: TestStep +commands: + # Annotate the namespace to allow the application to run using an specific group and user in OpenShift + # https://docs.openshift.com/dedicated/authentication/managing-security-context-constraints.html + # This annotation has no effect in Kubernetes + - script: kubectl annotate namespace ${NAMESPACE} openshift.io/sa.scc.uid-range=0/0 --overwrite + - script: kubectl annotate namespace ${NAMESPACE} openshift.io/sa.scc.supplemental-groups=2000/1000 --overwrite + # Add the SCC + - script: ./add-scc.sh diff --git a/tests/e2e/instrumentation-go/01-assert.yaml b/tests/e2e/instrumentation-go/02-assert.yaml similarity index 100% rename from tests/e2e/instrumentation-go/01-assert.yaml rename to tests/e2e/instrumentation-go/02-assert.yaml diff --git a/tests/e2e/instrumentation-go/01-install-app.yaml b/tests/e2e/instrumentation-go/02-install-app.yaml similarity index 84% rename from tests/e2e/instrumentation-go/01-install-app.yaml rename to tests/e2e/instrumentation-go/02-install-app.yaml index 1650adf300..527ca4491a 100644 --- a/tests/e2e/instrumentation-go/01-install-app.yaml +++ b/tests/e2e/instrumentation-go/02-install-app.yaml @@ -16,6 +16,11 @@ spec: instrumentation.opentelemetry.io/inject-go: "true" instrumentation.opentelemetry.io/otel-go-auto-target-exe: /usr/src/app/productcatalogservice spec: + serviceAccountName: otel-instrumentation-go + securityContext: + runAsUser: 0 + runAsGroup: 3000 + fsGroup: 2000 containers: - name: productcatalogservice image: ghcr.io/open-telemetry/demo:1.3.1-productcatalogservice diff --git a/tests/e2e/instrumentation-go/add-scc.sh b/tests/e2e/instrumentation-go/add-scc.sh new file mode 100755 index 0000000000..d5bb738b36 --- /dev/null +++ b/tests/e2e/instrumentation-go/add-scc.sh @@ -0,0 +1,6 @@ +#!/bin/bash + +if [[ "$(kubectl api-resources --api-group=operator.openshift.io -o name)" ]]; then + kubectl apply -f scc.yaml + oc adm policy add-scc-to-user otel-go-instrumentation -z otel-instrumentation-go -n $NAMESPACE +fi diff --git a/tests/e2e/instrumentation-go/scc.yaml b/tests/e2e/instrumentation-go/scc.yaml new file mode 100644 index 0000000000..45891eb6d3 --- /dev/null +++ b/tests/e2e/instrumentation-go/scc.yaml @@ -0,0 +1,19 @@ +apiVersion: security.openshift.io/v1 +kind: SecurityContextConstraints +metadata: + name: otel-go-instrumentation +allowHostDirVolumePlugin: true +allowPrivilegeEscalation: true +allowPrivilegedContainer: true +allowedCapabilities: +- 'SYS_PTRACE' +fsGroup: + type: RunAsAny +runAsUser: + type: RunAsAny +seLinuxContext: + type: RunAsAny +seccompProfiles: +- '*' +supplementalGroups: + type: RunAsAny