Make the go-autoinstrumentation E2E test work in OpenShift (#1920)

tests/e2e/instrumentation-go/01-add-scc.yaml

@@ -0,0 +1,16 @@
+# Create a SA to apply the SCC policy
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: otel-instrumentation-go
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  # Annotate the namespace to allow the application to run using an specific group and user in OpenShift
+  # https://docs.openshift.com/dedicated/authentication/managing-security-context-constraints.html
+  # This annotation has no effect in Kubernetes
+  - script: kubectl annotate namespace ${NAMESPACE} openshift.io/sa.scc.uid-range=0/0 --overwrite
+  - script: kubectl annotate namespace ${NAMESPACE} openshift.io/sa.scc.supplemental-groups=2000/1000 --overwrite
+  # Add the SCC
+  - script: ./add-scc.sh

tests/e2e/instrumentation-go/01-install-app.yaml → tests/e2e/instrumentation-go/02-install-app.yaml

@@ -16,6 +16,11 @@ spec:
         instrumentation.opentelemetry.io/inject-go: "true"
         instrumentation.opentelemetry.io/otel-go-auto-target-exe: /usr/src/app/productcatalogservice
     spec:
+      serviceAccountName: otel-instrumentation-go
+      securityContext:
+        runAsUser: 0
+        runAsGroup: 3000
+        fsGroup: 2000
       containers:
       - name: productcatalogservice
         image: ghcr.io/open-telemetry/demo:1.3.1-productcatalogservice

tests/e2e/instrumentation-go/add-scc.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+
+if [[ "$(kubectl api-resources --api-group=operator.openshift.io -o name)" ]]; then
+    kubectl apply -f scc.yaml
+    oc adm policy add-scc-to-user otel-go-instrumentation -z otel-instrumentation-go -n $NAMESPACE
+fi

tests/e2e/instrumentation-go/scc.yaml

@@ -0,0 +1,19 @@
+apiVersion: security.openshift.io/v1
+kind: SecurityContextConstraints
+metadata:
+  name: otel-go-instrumentation
+allowHostDirVolumePlugin: true
+allowPrivilegeEscalation: true
+allowPrivilegedContainer: true
+allowedCapabilities:
+- 'SYS_PTRACE'
+fsGroup:
+  type: RunAsAny
+runAsUser:
+  type: RunAsAny
+seLinuxContext:
+  type: RunAsAny
+seccompProfiles:
+- '*'
+supplementalGroups:
+  type: RunAsAny