selinuxpolicy: updates to enable support for OCP 4.11+/K8s 1.24+

[swatisehgal]

In container-selinux versions v2.186.0, v2.187.0 and v2.188.0, due to the updates here:
containers/container-selinux@cf704e4
selinuxpolicy updates are required (updating container_runtime_t to kubelet_t).

This is consumed in OCP 4.11 and K8s 1.24 and we need to make sure that the selinuxpolicy is
appropriately updated.

In addition to that, we need to continue supporting the older selinuxpolicy supplied in older
versions (e.g. 4.10) and that is the reason this patch is proposing an additional selinuxpolicy
and not completely replacing the original one.

Signed-off-by: Swati Sehgal [email protected]

[swatisehgal]

/cc @fromanirh

[ffromani]

very nice start!

[ffromani]

thanks for the updates. Looks very good. It seems to me that we only miss to update the pkg/commands/deploy.go source/command (we're running out of good names!), like this:

diff --git a/pkg/commands/deploy.go b/pkg/commands/deploy.go
index 4bdcba0..8d24a7c 100644
--- a/pkg/commands/deploy.go
+++ b/pkg/commands/deploy.go
@@ -30,6 +30,7 @@ import (
 
 type DeployOptions struct {
        clusterPlatform platform.Platform
+       clusterVersion  platform.Version
        waitCompletion  bool
 }
 
@@ -62,6 +63,11 @@ func NewRemoveCommand(commonOpts *CommonOptions) *cobra.Command {
                        if opts.clusterPlatform == platform.Unknown {
                                return fmt.Errorf("cannot autodetect the platform, and no platform given")
                        }
+                       verDetect := detectVersion(commonOpts.DebugLog, platDetect.Discovered, commonOpts.UserPlatformVersion)
+                       opts.clusterVersion = verDetect.Discovered
+                       if opts.clusterVersion == platform.MissingVersion {
+                               return fmt.Errorf("cannot autodetect the platform version, and no version given")
+                       }

(note your naming is actually better than the one I used in the quick example above, please use yours :) )

similar changes would be needed all across pkg/commands/deploy.go if I'm right
Unfortunately it's likely the existing e2e test don't cover well enough this flow. If nothing else, we're still on 1.23 in our CI lane.
Surely improving CI can be deferred to another PR.

[ffromani]

minor improvements inside

[swatisehgal]

Need to tidy up a couple of things, on it now.

[ffromani]

almost there. You properly detect the version in the right places, but we need to pass it through another layer

[ffromani]

LGTM
we detect the version in more places than is strictly needed. But let's keep it this way, should make the overall UX less surprising.