Make tests succeed on OpenShift

tests/templates/kuttl/kerberos/00-rbac.yaml.j2

@@ -0,0 +1,30 @@
+---
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: use-integration-tests-scc
+rules:
+{% if test_scenario['values']['openshift'] == "true" %}
+  - apiGroups: ["security.openshift.io"]
+    resources: ["securitycontextconstraints"]
+    resourceNames: ["privileged"]
+    verbs: ["use"]
+{% endif %}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: integration-tests-sa
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: use-integration-tests-scc
+subjects:
+  - kind: ServiceAccount
+    name: integration-tests-sa
+roleRef:
+  kind: Role
+  name: use-integration-tests-scc
+  apiGroup: rbac.authorization.k8s.io
+

tests/templates/kuttl/kerberos/01-install-kdc.yaml

@@ -17,6 +17,9 @@ spec:
       labels:
         app: krb5-kdc
     spec:
+      serviceAccount: integration-tests-sa
+      securityContext:
+        runAsUser: 0
       initContainers:
         - name: init
           image: docker.stackable.tech/stackable/krb5:1.18.2-stackable23.4.0-rc1

tests/templates/kuttl/kerberos/kinit-client.yaml

@@ -7,6 +7,7 @@ metadata:
 spec:
   template:
     spec:
+      serviceAccount: integration-tests-sa
       containers:
         - name: client
           image: docker.stackable.tech/stackable/krb5:1.18.2-stackable23.4.0-rc1

tests/templates/kuttl/listener/00-rbac.yaml.j2

@@ -0,0 +1,30 @@
+---
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: use-integration-tests-scc
+rules:
+{% if test_scenario['values']['openshift'] == "true" %}
+  - apiGroups: ["security.openshift.io"]
+    resources: ["securitycontextconstraints"]
+    resourceNames: ["privileged"]
+    verbs: ["use"]
+{% endif %}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: integration-tests-sa
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: use-integration-tests-scc
+subjects:
+  - kind: ServiceAccount
+    name: integration-tests-sa
+roleRef:
+  kind: Role
+  name: use-integration-tests-scc
+  apiGroup: rbac.authorization.k8s.io
+

tests/templates/kuttl/listener/01-install-nginx.yaml

@@ -14,6 +14,9 @@ spec:
       labels:
         app: nginx
     spec:
+      serviceAccount: integration-tests-sa
+      securityContext:
+        runAsUser: 0
       containers:
       - name: nginx
         image: nginx:latest

tests/templates/kuttl/listener/02-client.yaml → tests/templates/kuttl/listener/02-client.yaml.j2

@@ -21,6 +21,12 @@ rules:
       - pods
     verbs:
       - get
+{% if test_scenario['values']['openshift'] == "true" %}
+  - apiGroups: ["security.openshift.io"]
+    resources: ["securitycontextconstraints"]
+    resourceNames: ["privileged"]
+    verbs: ["use"]
+{% endif %}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -41,6 +47,7 @@ metadata:
 spec:
   template:
     spec:
+      serviceAccount: client-sa
       containers:
         - name: client
           image: docker.stackable.tech/stackable/testing-tools:0.2.0-stackable0.0.0-dev

tests/templates/kuttl/tls/02-rbac.yaml.j2

@@ -0,0 +1,30 @@
+---
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: use-integration-tests-scc
+rules:
+{% if test_scenario['values']['openshift'] == "true" %}
+  - apiGroups: ["security.openshift.io"]
+    resources: ["securitycontextconstraints"]
+    resourceNames: ["privileged"]
+    verbs: ["use"]
+{% endif %}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: integration-tests-sa
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: use-integration-tests-scc
+subjects:
+  - kind: ServiceAccount
+    name: integration-tests-sa
+roleRef:
+  kind: Role
+  name: use-integration-tests-scc
+  apiGroup: rbac.authorization.k8s.io
+

tests/templates/kuttl/tls/consumer.yaml

@@ -80,3 +80,4 @@ spec:
         fsGroup: 1000
       restartPolicy: Never
       terminationGracePeriodSeconds: 0
+      serviceAccount: integration-tests-sa

tests/test-definition.yaml

@@ -1,14 +1,25 @@
 ---
-dimensions: []
+dimensions:
+  - name: openshift
+    values:
+      - "false"
 tests:
   - name: kerberos
-    dimensions: []
+    dimensions:
+      - openshift
     # Requires manual connection to an AD cluster
     # - name: kerberos-ad
     #   dimensions: []
   - name: listener
-    dimensions: []
+    dimensions:
+      - openshift
   - name: tls
-    dimensions: []
+    dimensions:
+      - openshift
 suites:
   - name: nightly
+  - name: openshift
+    patch:
+      - dimensions:
+          - name: openshift
+            expr: "true"