Undeploying bpfman selinux example programs hang on OpenShift

[anfredette]

Running make deploy-*-selinux to an OpenShift cluster seems to work, but make undeploy-*-selinux hangs.

On closer inspection, after deploying, the selinux profile stays in the “Pending” state which doesn’t seem right. Then, after running the undeploy command, the namespace is waiting on an selinux profile and a number of finalizers.

For more details search for the test case starting with "$ k apply -f go-tracepoint-counter-install-selinux.yaml" in bpfman Selinux Test.

[Billy99]

There are two issues here:

On closer inspection, after deploying, the selinux profile stays in the “Pending” state which doesn’t seem right.

This is because security-profiles-operator is currently deployed in OpenShift by making it a dependency of bpfman-operator via config/manifests/dependencies.yaml. As a result, the security-profiles-operator is deployed in the bpfman namespace. security-profiles-operator encounters issues with this because there are other daemonsets in the namespace.

See: kubernetes-sigs/security-profiles-operator#2699

Then, after running the undeploy command, the namespace is waiting on an selinux profile and a number of finalizers.

Upon further testing, if the application namespace is not deleted until after the SelinuxProfile is deleted, everything cleans up fine. This is a bug in security-profiles-operator.

See: kubernetes-sigs/security-profiles-operator#2684