SPIRE-525: Add e2e tests for SCC hardening (PR #105) and enhance test generation rules

- Add Security hardening Context to e2e_test.go with two tests:
  - SCC field validation (AllowHostNetwork, AllowPrivilegeEscalation, etc.)
  - DaemonSet and pod security context verification (Privileged, ReadOnlyRootFilesystem, Capabilities.Drop)
- Register securityv1 scheme in e2e_suite_test.go for SCC object access
- Add SpireAgentSCCName constant to constants.go
- Enhance e2e-rules.md Step 6 and Step 7 with structured test case IDs,
  priority levels, coverage gap fields, and per-step expected results
- Add test plan document in output/pr-105/test-cases.md

Made-with: Cursor

Author: Super User

.cursor/rules/e2e-rules.md

@@ -147,37 +147,62 @@ For each scenario, decide:
 | Related file exists but different scenario | `new-in-file` -- add new `Context`/`It` in the existing file |
 | No match at all | `new-file` -- create new `*_test.go` (only if truly distinct) |
 
-### Step 6: Prioritize (Top 10 most impactful)
+### Step 6: Generate Top 10 Most Impactful Missing Tests
 
-Rank the missing test scenarios using these ZTWIM-specific categories.
-Focus **only** on scenarios NOT already covered:
+Select the **10 most impactful** test scenarios **NOT already covered** by
+existing specs (confirmed via Step 5 dedup). Rank using these categories:
 
 | # | Category | What to test |
 |---|---|---|
-| 1 | **Core SPIFFE/SPIRE functionality** | Workload attestation, SVID issuance, trust bundle distribution, CSI volume mount, ClusterSPIFFEID |
-| 2 | **Operand lifecycle** | CR create/update/delete for each of the 4 operands, condition checks (Ready, all sub-conditions), aggregate status on ZeroTrustWorkloadIdentityManager |
-| 3 | **Security hardening** | SCC field validation (AllowHostNetwork, AllowPrivilegeEscalation, etc.), pod SecurityContext (runAsNonRoot, drop ALL, readOnlyRootFilesystem), restricted-v2 SCC compliance |
-| 4 | **Configuration edge cases** | Invalid CRs (missing required fields, out-of-range TTL, invalid persistence size), webhook rejection, boundary values |
-| 5 | **Reconciliation and self-healing** | Pod deletion recovery (operator, server, agent, CSI), ConfigMap drift correction, CreateOnlyMode pause/resume |
-| 6 | **OLM integration** | Subscription-based install, upgrade path (channel switching), uninstall cleanup, OperatorCondition.Upgradeable transition on pod failure |
-| 7 | **Multi-operand coordination** | ZeroTrustWorkloadIdentityManager aggregate status, cross-operand dependency (Agent needs Server running), concurrent pod failures across operands |
-| 8 | **OpenShift platform integration** | SCC objects on cluster, RBAC ClusterRoles, ServiceMonitor (if applicable), audit logging, version compatibility (min 2 OCP versions) |
-| 9 | **Error handling and negative cases** | Invalid input rejection by webhooks, permission denial, missing CRDs, operator behavior when ZeroTrustWorkloadIdentityManager CR is missing |
-| 10 | **Operational day-2** | Log level changes (Subscription env + CR spec), resource limits/requests, node scheduling (nodeSelector, tolerations, affinity), custom labels propagation |
-
-For each PR/Jira, identify which categories are impacted. Generate test
-cases for the impacted categories first, then fill gaps in un-covered
-categories if the change is broad.
+| 1 | **Core Functionality** | Primary use cases: workload attestation, SVID issuance, trust bundle distribution, CSI volume mount, ClusterSPIFFEID, operand CR lifecycle |
+| 2 | **Configuration Edge Cases** | Invalid/boundary configurations: missing required fields, out-of-range TTL, invalid persistence size, webhook rejection, min/max boundary values |
+| 3 | **Dynamic Behavior** | Runtime changes not tested: log-level reload, resource limit changes, CreateOnlyMode toggle, ConfigMap drift correction, rolling update tracking |
+| 4 | **Integration Gaps** | Component interactions not validated: cross-operand dependency (Agent needs Server), ZeroTrustWorkloadIdentityManager aggregate status, OLM Subscription propagation |
+| 5 | **Multi-tenant / Namespace** | Cross-namespace scenarios: ClusterSPIFFEID with namespace selectors, workload attestation across namespaces, RBAC scoping per namespace |
+| 6 | **Error Handling** | Failure modes not covered: permission denial, missing CRDs, operator behavior when parent CR is absent, pod crash recovery, cascading failures |
+| 7 | **Upgrade / Compatibility** | Version compatibility gaps: OLM upgrade path (channel switching), CSV replacement chain, uninstall cleanup, OperatorCondition.Upgradeable transitions |
+| 8 | **Performance** | Load/scale testing if missing: large number of ClusterSPIFFEIDs, concurrent attestation, DaemonSet rollout on many-node clusters |
+| 9 | **Security** | Permission/isolation tests: SCC field validation, pod SecurityContext (runAsNonRoot, drop ALL, readOnlyRootFilesystem), restricted-v2 SCC compliance, RBAC least-privilege |
+| 10 | **Real Customer Scenarios** | Use cases from the RFE/Jira not tested: end-to-end workflows described in the ticket, production-like topologies, day-2 operational patterns |
+
+**Prioritization rules:**
+
+- For each PR/Jira, identify which categories are impacted by the diff.
+- Generate test cases for impacted categories **first**, then fill gaps in
+  un-covered categories if the change is broad.
+- Assign a priority to each test case:
+  - **Critical** -- blocks core functionality or security; must pass before merge.
+  - **High** -- important gap in coverage; should be addressed in the same release.
+  - **Medium** -- nice-to-have hardening; can be deferred if time-constrained.
+
+**Test case ID format:**
+
+Use `<TICKET>-TC-NNN` where `<TICKET>` is the source identifier:
+
+| Source | ID example |
+|---|---|
+| Jira `SPIRE-439` | `SPIRE-439-TC-001` |
+| Jira `OCPSTRAT-1234` | `OCPSTRAT-1234-TC-001` |
+| GitHub PR #105 | `PR-105-TC-001` |
+
+Number sequentially (`TC-001`, `TC-002`, ...) within a single test plan.
 
 ### Step 7: Generate test-cases.md
 
-Write the test plan to a local output directory:
+Write the test plan to a local output directory. Use the Jira key when
+available, otherwise use the PR number:
 
 ```bash
-mkdir -p output/${JIRA_KEY:-pr-$PR_NUMBER}
+# Jira source
+mkdir -p output/${JIRA_KEY}
+# GitHub PR source
+mkdir -p output/pr-${PR_NUMBER}
 ```
 
-Use this template for `output/<key>/test-cases.md`:
+File name: `test-cases.md` (e.g. `output/SPIRE-439/test-cases.md` or
+`output/pr-105/test-cases.md`).
+
+Use this template:
 
 ```markdown
 # Test Plan: <title>
@@ -191,19 +216,22 @@ Use this template for `output/<key>/test-cases.md`:
 
 ## Test Cases
 
-### TC-001: <Title> [P0]
-**Domain:** <domain-key>
-**Category:** <one of the 10 categories above>
-**OpenShift-specific:** yes/no
-**Scope:** <keywords>
-**Prerequisites:** <cluster state, CRDs, namespaces>
+### <TICKET>-TC-001: <Title>
+**Priority:** Critical | High | Medium
+**Domain:** <domain-key(s) from Section 6>
+**Category:** <one of the 10 categories from Step 6>
+**OpenShift-specific:** yes / no
+**Coverage Gap:** <What existing tests do NOT cover that this test fills.>
+**Prerequisites:** <cluster state, CRDs, namespaces, operator version>
 **Steps:**
-1. ...
-2. ...
-**Expected result:** ...
+1. <Concrete action with actual config/commands>
+   **Expected:** <What should happen after this step>
+2. <Next action>
+   **Expected:** <Outcome>
+3. ...
 **Stop condition:** <which later TCs are blocked if this fails>
 
-(repeat for TC-002, TC-003, ...)
+(repeat for <TICKET>-TC-002, <TICKET>-TC-003, ... up to 10)
 
 ## Coverage Map
 
@@ -241,6 +269,17 @@ Use this template for `output/<key>/test-cases.md`:
 Mark each checklist item `[x]` if a TC covers it. Append a warning for
 missing items.
 
+**Writing good test steps:**
+
+- Each step must be **concrete**: include the actual API call, kubectl
+  command, CR YAML snippet, or Go assertion -- not vague prose.
+- Every step must have its own **Expected** line describing the observable
+  outcome (HTTP status, condition value, field value, pod state, etc.).
+- If a step creates a resource, note the cleanup requirement
+  (`DeferCleanup` in the eventual e2e code).
+- Group related assertions into one step when they all verify the same
+  object (e.g. "Verify SCC fields" with multiple Expected sub-bullets).
+
 **Default behavior stops here.** Steps 8-9 below run only if the user
 explicitly asks to generate e2e code or raise a PR.
 

output/pr-105/test-cases.md

@@ -0,0 +1,113 @@
+# Test Plan: SCC Hardening for Spire Agent and CSI Driver
+
+<!-- Source: https://github.com/openshift/zero-trust-workload-identity-manager/pull/105 -->
+<!-- Repo: openshift/zero-trust-workload-identity-manager -->
+<!-- Framework: controller-runtime (operator-sdk) | Ginkgo v2 -->
+
+## Summary
+
+PR #105 hardens the security posture of the SPIRE Agent by disabling host
+networking, removing privileged mode, enforcing read-only root filesystem,
+dropping all Linux capabilities, and updating the custom
+SecurityContextConstraints to restrict host access and privilege escalation.
+E2E tests must verify that these hardened settings are applied to the SCC
+object, the DaemonSet spec, and the running pods on a live OpenShift cluster.
+
+## Test Cases
+
+### PR-105-TC-001: SPIRE Agent SCC field validation after hardening
+**Priority:** Critical
+**Domain:** openshift-scc, security-context
+**Category:** Security
+**OpenShift-specific:** yes
+**Coverage Gap:** Existing e2e only checks the `SecurityContextConstraintsAvailable` condition (boolean). No test fetches the actual `spire-agent` SCC object to verify individual field values like AllowHostNetwork, AllowPrivilegeEscalation, or RequiredDropCapabilities.
+**Prerequisites:** Operator installed via OLM, SpireAgent CR `cluster` created, `SecurityContextConstraintsAvailable` condition is True
+**Steps:**
+1. `k8sClient.Get(ctx, client.ObjectKey{Name: "spire-agent"}, scc)` -- fetch the SCC object from the cluster
+   **Expected:** SCC object exists and is retrievable without error
+2. Assert SCC host-access fields:
+   - `scc.AllowHostNetwork == false`
+   - `scc.AllowHostPorts == false`
+   - `scc.AllowPrivilegedContainer == false`
+   - `*scc.AllowPrivilegeEscalation == false`
+   **Expected:** All four fields are restrictive (false)
+3. Assert SCC retains required host access:
+   - `scc.AllowHostPID == true`
+   - `scc.AllowHostDirVolumePlugin == true`
+   **Expected:** Both remain true (required for node attestation and socket dir)
+4. Assert SCC filesystem and capability restrictions:
+   - `scc.ReadOnlyRootFilesystem == true`
+   - `scc.RequiredDropCapabilities` contains `"ALL"`
+   **Expected:** Filesystem is read-only and all capabilities are dropped
+5. Assert SCC RunAsUser strategy:
+   - `scc.RunAsUser.Type == RunAsUserStrategyRunAsAny`
+   **Expected:** RunAsUser is RunAsAny
+**Stop condition:** PR-105-TC-002 depends on the SCC being correctly applied (SCC governs pod admission)
+
+### PR-105-TC-002: SPIRE Agent DaemonSet and pod security context verification
+**Priority:** Critical
+**Domain:** security-context, controller-manager
+**Category:** Security
+**OpenShift-specific:** no
+**Coverage Gap:** Existing e2e waits for `DaemonSetAvailable` (replica count) but never inspects the DaemonSet pod template or running pod security settings. No test verifies HostNetwork, HostPID, DNSPolicy, Privileged, AllowPrivilegeEscalation, ReadOnlyRootFilesystem, or Capabilities.Drop on the spire-agent workload.
+**Prerequisites:** Operator installed via OLM, SpireAgent CR `cluster` created, DaemonSet `spire-agent` is available with all pods running
+**Steps:**
+1. `clientset.AppsV1().DaemonSets(ns).Get(ctx, "spire-agent", ...)` -- fetch the DaemonSet
+   **Expected:** DaemonSet exists and is retrievable without error
+2. Assert DaemonSet pod template spec:
+   - `podSpec.HostNetwork == false`
+   - `podSpec.HostPID == true`
+   - `podSpec.DNSPolicy == corev1.DNSClusterFirst`
+   **Expected:** Host networking disabled, host PID retained, DNS policy matches non-host-network mode
+3. Find the `spire-agent` container in the pod template and assert its SecurityContext:
+   - `sc.Privileged == ptr.To(false)`
+   - `sc.AllowPrivilegeEscalation == ptr.To(false)`
+   - `sc.ReadOnlyRootFilesystem == ptr.To(true)`
+   - `sc.Capabilities.Drop` contains `"ALL"`
+   **Expected:** Container runs unprivileged with minimal capabilities
+4. `clientset.CoreV1().Pods(ns).List(ctx, {LabelSelector: "app.kubernetes.io/name=spire-agent"})` -- list running pods
+   **Expected:** At least one pod exists (DaemonSet should schedule one per node)
+5. For each running pod, assert the same fields from steps 2-3 on the live pod spec
+   **Expected:** All running pods reflect the hardened template (no drift between template and actual)
+**Stop condition:** Attestation tests are blocked if spire-agent pods fail to start under the hardened security context
+
+## Coverage Map
+
+| Scenario | Existing spec | Domain | Decision |
+|---|---|---|---|
+| SCC AllowHostNetwork/Ports/Privileged fields | (none) | openshift-scc | new-in-file |
+| SCC AllowPrivilegeEscalation field | (none) | openshift-scc | new-in-file |
+| SCC ReadOnlyRootFilesystem field | (none) | openshift-scc | new-in-file |
+| SCC RequiredDropCapabilities field | (none) | openshift-scc | new-in-file |
+| SCC RunAsUser strategy | (none) | openshift-scc | new-in-file |
+| DaemonSet HostNetwork=false, DNSPolicy | (none) | security-context | new-in-file |
+| DaemonSet container SecurityContext | (none) | security-context | new-in-file |
+| Running pod security context | (none) | security-context | new-in-file |
+| SecurityContextConstraintsAvailable condition | test/e2e/e2e_test.go:246 | openshift-scc | skip (already covered) |
+| DaemonSet available after install | test/e2e/e2e_test.go:252 | controller-manager | skip (already covered) |
+
+## OLM Coverage
+- Subscription install: covered (existing Installation context)
+- Channel switching: not covered
+- Upgrade path: not covered
+- Dependency management: not covered
+- Uninstall cleanup: not covered
+
+## OpenShift Coverage
+- SCC validation: **covered (PR-105-TC-001)**
+- RBAC scoping: covered (existing)
+- Image scanning: not covered
+- Prometheus metrics: not covered
+- Audit logging: not covered
+- Version compatibility: not covered
+
+## Red Hat Certification Checklist
+- [x] OLM install
+- [x] SCC validation
+- [x] RBAC least-privilege
+- [ ] Image scanning / signing
+- [ ] Prometheus metrics
+- [ ] Audit logging
+- [ ] Version compatibility
+- [ ] Uninstall cleanup
+- [x] Security context

test/e2e/e2e_suite_test.go

@@ -23,6 +23,7 @@ import (
 
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
+	securityv1 "github.com/openshift/api/security/v1"
 	configv1 "github.com/openshift/client-go/config/clientset/versioned/typed/config/v1"
 	operatorv1alpha1 "github.com/openshift/zero-trust-workload-identity-manager/api/v1alpha1"
 	"github.com/openshift/zero-trust-workload-identity-manager/test/e2e/utils"
@@ -58,6 +59,7 @@ var _ = BeforeSuite(func() {
 	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
 	utilruntime.Must(operatorv1alpha1.AddToScheme(scheme))
 	utilruntime.Must(operatorv1.AddToScheme(scheme))
+	utilruntime.Must(securityv1.AddToScheme(scheme))
 	utilruntime.Must(spiffev1alpha1.AddToScheme(scheme))
 
 	// Create controller-runtime client