OCPBUGS-4787: merging: Fix the mergeStrategy=containers option

[jhrozek]

Backports kubernetes-sigs#1380 which should fix https://issues.redhat.com/browse/OCPBUGS-4787

It's unusual to send a backport before an upstream patch is merged, but I'm doing that because:

• the holiday season starts soon and reviews might take longer
• the upstream CI tests that run the upstream e2e tests on Flatcar are not working at the moment which is blocking merges upstream
• I want to get the PR through the OCP CI to see if there's any failures
• I want to give QE a head start testing the PR

We can
/hold
the PR until the original upstream PR is reviewed and merged.

[openshift-ci-robot]

@jhrozek: This pull request references Jira Issue OCPBUGS-4787, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.13.0) matches configured target version for branch (4.13.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @xiaojiey

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Backports kubernetes-sigs#1380 which should fix https://issues.redhat.com/browse/OCPBUGS-4787

It's unusual to send a backport before an upstream patch is merged, but I'm doing that because:

• the holiday season starts soon and reviews might take longer
  

• the upstream CI tests that run the upstream e2e tests on Flatcar are not working at the moment which is blocking merges upstream
• I want to get the PR through the OCP CI to see if there's any failures
• I want to give QE a head start testing the PR

We can
/hold
the PR until the original upstream PR is reviewed and merged.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci-robot]

@jhrozek: This pull request references Jira Issue OCPBUGS-4787, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.13.0) matches configured target version for branch (4.13.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @xiaojiey

In response to this:

Backports kubernetes-sigs#1380 which should fix https://issues.redhat.com/browse/OCPBUGS-4787

It's unusual to send a backport before an upstream patch is merged, but I'm doing that because:

• the holiday season starts soon and reviews might take longer
• the upstream CI tests that run the upstream e2e tests on Flatcar are not working at the moment which is blocking merges upstream
• I want to get the PR through the OCP CI to see if there's any failures
• I want to give QE a head start testing the PR

We can
/hold
the PR until the original upstream PR is reviewed and merged.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[jhrozek]

@xiaojiey to test, you can deploy with make deploy-openshift-dev as there are no packaging changes.

[xiaojiey]

Verification pass with 4.13.0-0.nightly-2022-12-12-210406 + latest code:
After this PR, there will be only one selinuxprofile generated after merge.
With this PR, the final selinuxprofile generated is per container.

Test steps:

1. install SPO
2. Enable log Enrisher
3. Create a new namespace mytest. To record by using the enricher, create a ProfileRecording which is using recorder
4. Create the severice account with privileged permission:
5. Add label for ns and create deployment to be recorded:
$ oc label ns mytest security.openshift.io/scc.podSecurityLabelSync=false pod-security.kubernetes.io/enforce=privileged --overwrite=true
$ oc apply -f -<<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
name: hello-openshift
namespace: mytest
spec:
replicas: 3
selector:
matchLabels:
app: hello-openshift
template:
metadata:
labels:
app: hello-openshift
spec:
serviceAccountName: spo-record-sa
initContainers:
name: wait
image: quay.io/openshifttest/centos:centos7
command: ["/bin/sh", "-c", "env"]
containers:
name: hello-openshift
image: quay.io/openshifttest/hello-openshift:multiarch
ports:
containerPort: 8080
readinessProbe:
tcpSocket:
port: 8080
initialDelaySeconds: 5
periodSeconds: 5
name: hello-openshift2
image: quay.io/openshifttest/hello-openshift:multiarch-fedora
ports:
containerPort: 8081
readinessProbe:
tcpSocket:
port: 8081
initialDelaySeconds: 5
periodSeconds: 5
EOF
deployment.apps/hello-openshift created
$ oc delete deployment hello-openshift
deployment.apps "hello-openshift" deleted
$ oc get selinuxprofiles.security-profiles-operator.x-k8s.io 
NAME                                    USAGE                                                  STATE
test-recording-hello-openshift-kpmvf    test-recording-hello-openshift-kpmvf_mytest.process    Partial
test-recording-hello-openshift-lg95s    test-recording-hello-openshift-lg95s_mytest.process    Partial
test-recording-hello-openshift2-kpmvf   test-recording-hello-openshift2-kpmvf_mytest.process   Partial
test-recording-hello-openshift2-lg95s   test-recording-hello-openshift2-lg95s_mytest.process   Partial
$ oc delete profilerecordings.security-profiles-operator.x-k8s.io test-recording
profilerecording.security-profiles-operator.x-k8s.io "test-recording" deleted
$ oc get selinuxprofiles.security-profiles-operator.x-k8s.io  -w
NAME                              USAGE                                            STATE
test-recording-hello-openshift    test-recording-hello-openshift_mytest.process    Pending
test-recording-hello-openshift2   test-recording-hello-openshift2_mytest.process   InProgress
$ oc get selinuxprofiles
NAME                              USAGE                                            STATE
test-recording-hello-openshift    test-recording-hello-openshift_mytest.process    Installed
test-recording-hello-openshift2   test-recording-hello-openshift2_mytest.process   Installed

[xiaojiey]

/qe-approved

[Vincent056]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jhrozek, Vincent056

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [Vincent056,jhrozek]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jhrozek]

/hold cancel
since everyone seems to be on vacation, I'm removing the hold and merging the patch downstream first.
If there are changes requested to the upstream patch, we're going to revert this PR and apply the pure upstream patches.

[openshift-ci]

@jhrozek: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[openshift-ci-robot]

@jhrozek: All pull requests linked via external trackers have merged:

• openshift/security-profiles-operator#21

Jira Issue OCPBUGS-4787 has been moved to the MODIFIED state.

In response to this:

Backports kubernetes-sigs#1380 which should fix https://issues.redhat.com/browse/OCPBUGS-4787

It's unusual to send a backport before an upstream patch is merged, but I'm doing that because:

• the holiday season starts soon and reviews might take longer
• the upstream CI tests that run the upstream e2e tests on Flatcar are not working at the moment which is blocking merges upstream
• I want to get the PR through the OCP CI to see if there's any failures
• I want to give QE a head start testing the PR

We can
/hold
the PR until the original upstream PR is reviewed and merged.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.