Merge pull request #299 from cblecker/remove-scc-osde2e

Remove osde2e exception from modifying SCCs

Author: openshift-merge-bot[bot]

pkg/webhooks/scc/scc.go

@@ -3,7 +3,6 @@ package scc
 import (
 	"fmt"
 	"net/http"
-	"regexp"
 	"slices"
 
 	securityv1 "github.com/openshift/api/security/v1"
@@ -41,8 +40,8 @@ var (
 		"system:serviceaccount:openshift-cluster-version:default",
 		"system:admin",
 	}
-	allowedGroupsRe = regexp.MustCompile("^system:serviceaccounts:osde2e-(h-)?[a-z0-9]{5}")
-	defaultSCCs     = []string{
+	allowedGroups = []string{}
+	defaultSCCs   = []string{
 		"anyuid",
 		"hostaccess",
 		"hostmount-anyuid",
@@ -126,8 +125,8 @@ func isAllowedUserGroup(request admissionctl.Request) bool {
 		return true
 	}
 
-	for _, group := range request.UserInfo.Groups {
-		if allowedGroupsRe.Match([]byte(group)) {
+	for _, group := range allowedGroups {
+		if slices.Contains(request.UserInfo.Groups, group) {
 			return true
 		}
 	}

pkg/webhooks/scc/scc_test.go

@@ -79,7 +79,7 @@ func runSCCTests(t *testing.T, tests []sccTestSuites) {
 		}
 	}
 }
-func TestUserNegative(t *testing.T) {
+func TestUser(t *testing.T) {
 	tests := []sccTestSuites{
 		{
 			targetSCC:       "hostnetwork",
@@ -121,12 +121,6 @@ func TestUserNegative(t *testing.T) {
 			userGroups:      []string{"system:authenticated", "system:authenticated:oauth"},
 			shouldBeAllowed: false,
 		},
-	}
-	runSCCTests(t, tests)
-}
-
-func TestUserPositive(t *testing.T) {
-	tests := []sccTestSuites{
 		{
 			targetSCC:       "testscc",
 			testID:          "user-can-modify-normal",
@@ -169,11 +163,11 @@ func TestUserPositive(t *testing.T) {
 		},
 		{
 			targetSCC:       "privileged",
-			testID:          "osde2e-serviceaccounts-are-allowed",
+			testID:          "osde2e-serviceaccounts-are-not-allowed",
 			username:        "system:serviceaccount:osde2e-abcde:osde2e-runner",
 			operation:       admissionv1.Update,
 			userGroups:      []string{"system:authenticated", "system:serviceaccounts:osde2e-abcde"},
-			shouldBeAllowed: true,
+			shouldBeAllowed: false,
 		},
 	}
 	runSCCTests(t, tests)