OCPBUGS-29225: SCC user update should work correctly

.pre-commit-config.yaml

@@ -70,8 +70,8 @@ repos:
           "afterall",
           "--check-filenames",
           "--check-hidden",
-          "--exclude-file",
-          "go.sum"
+          "-S",
+          "test/e2e/testdata/*,go.sum,go.mod",
         ]
         exclude: ^vendor/
         pass_filenames: true

internal/controllers/lvmcluster/controller_integration_test.go

@@ -18,10 +18,12 @@ package lvmcluster
 
 import (
 	"context"
+	"fmt"
 	"time"
 
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
+	secv1 "github.com/openshift/api/security/v1"
 	lvmv1alpha1 "github.com/openshift/lvm-operator/api/v1alpha1"
 	"github.com/openshift/lvm-operator/internal/controllers/constants"
 	"github.com/openshift/lvm-operator/internal/controllers/lvmcluster/resource"
@@ -174,6 +176,31 @@ var _ = Describe("LVMCluster controller", func() {
 				}).WithContext(ctx).Should(Succeed())
 				scOut = &storagev1.StorageClass{}
 			}
+
+			By("confirming creation of the SecurityContextConstraints")
+			// we only have one SCC for vg-manager
+			scc := &secv1.SecurityContextConstraints{}
+			Eventually(func(ctx context.Context) error {
+				return k8sClient.Get(ctx, types.NamespacedName{Name: constants.SCCPrefix + "vgmanager"}, scc)
+			}).WithContext(ctx).Should(Succeed())
+			Expect(scc.Users).ToNot(BeEmpty())
+			Expect(scc.Users).To(ContainElement(
+				fmt.Sprintf("system:serviceaccount:%s:%s", testLvmClusterNamespace, constants.VGManagerServiceAccount)))
+			scc = nil
+
+			By("confirming overwriting the SCC User gets reset")
+			Eventually(func(ctx context.Context) []string {
+				oldSCC := &secv1.SecurityContextConstraints{}
+				Expect(k8sClient.Get(ctx, types.NamespacedName{Name: constants.SCCPrefix + "vgmanager"}, oldSCC)).To(Succeed())
+				Expect(k8sClient.Patch(ctx, oldSCC, client.RawPatch(types.MergePatchType, []byte(`{"users": []}`)))).To(Succeed())
+				return oldSCC.Users
+			}).WithContext(ctx).Should(BeEmpty())
+
+			Eventually(func(ctx context.Context) []string {
+				scc := &secv1.SecurityContextConstraints{}
+				Expect(k8sClient.Get(ctx, types.NamespacedName{Name: constants.SCCPrefix + "vgmanager"}, scc)).To(Succeed())
+				return scc.Users
+			}).WithContext(ctx).WithTimeout(5 * time.Second).Should(Not(BeEmpty()))
 		})
 	})
 

internal/controllers/lvmcluster/resource/scc.go

@@ -54,10 +54,19 @@ func (c openshiftSccs) GetName() string {
 func (c openshiftSccs) EnsureCreated(r Reconciler, ctx context.Context, cluster *lvmv1alpha1.LVMCluster) error {
 	logger := log.FromContext(ctx).WithValues("resourceManager", c.GetName())
 	sccs := getAllSCCs(r.GetNamespace())
-	for _, scc := range sccs {
+	for _, template := range sccs {
+		scc := &secv1.SecurityContextConstraints{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: template.Name,
+			},
+		}
+
 		result, err := cutil.CreateOrUpdate(ctx, r, scc, func() error {
+			if scc.CreationTimestamp.IsZero() {
+				template.DeepCopyInto(scc)
+			}
 			labels.SetManagedLabels(r.Scheme(), scc, cluster)
-			// no need to mutate any field
+			scc.Users = template.Users
 			return nil
 		})
 		if err != nil {

internal/controllers/lvmcluster/suite_test.go

@@ -30,6 +30,7 @@ import (
 	"github.com/openshift/lvm-operator/internal/controllers/node/removal"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes/scheme"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -75,8 +76,10 @@ var _ = BeforeSuite(func() {
 
 	By("bootstrapping test environment")
 	testEnv = &envtest.Environment{
-		CRDDirectoryPaths: []string{filepath.Join("..", "..", "..", "config", "crd", "bases"),
-			filepath.Join("..", "..", "..", "test", "e2e", "testdata")},
+		CRDDirectoryPaths: []string{
+			filepath.Join("..", "..", "..", "config", "crd", "bases"),
+			filepath.Join("..", "..", "..", "test", "e2e", "testdata"),
+		},
 		ErrorIfCRDPathMissing: true,
 		CRDInstallOptions: envtest.CRDInstallOptions{
 			CleanUpAfterUse: true,
@@ -108,6 +111,11 @@ var _ = BeforeSuite(func() {
 	Expect(err).NotTo(HaveOccurred())
 	Expect(k8sClient).NotTo(BeNil())
 
+	Expect(k8sClient.Create(ctx, &configv1.Infrastructure{
+		ObjectMeta: metav1.ObjectMeta{Name: "cluster"},
+		Spec:       configv1.InfrastructureSpec{},
+	})).To(Succeed())
+
 	k8sManager, err := ctrl.NewManager(cfg, ctrl.Options{
 		Scheme: scheme.Scheme,
 	})