Introduce security.openshift.io/psp-priority annotation on PSP for ho…

…lding SCC.Priroty value.

pkg/oc/admin/migrate/scc/scc.go

@@ -23,6 +23,11 @@ import (
 	"github.com/spf13/cobra"
 )
 
+// pspPriorityAnnotationKey is a name of the annotation that could be present on PodSecurityPolicy and specifies its priority.
+// It should be a number. An empty value means 0 priority. Higher values means that the policy has higher priority.
+// This is an equivalent of the SCC.Priority field but applies to PSP and it's required for seamless transition.
+const pspPriorityAnnotationKey = "security.openshift.io/psp-priority"
+
 var (
 	internalMigrateSCCShort = "Converts SCCs to similar PSPs"
 	internalMigrateSCCLong  = templates.LongDesc(`
@@ -130,6 +135,7 @@ func convertSccToPsp(scc *securityapi.SecurityContextConstraints) (*extensions.P
 	annotations := make(map[string]string)
 	extractSeccompProfiles(scc, annotations)
 	extractSysctls(scc, annotations)
+	extractPriority(scc, annotations)
 
 	selinux, err := extractSELinux(scc)
 	if err != nil {

pkg/oc/admin/migrate/scc/scc_to_psp.go

@@ -274,3 +274,10 @@ func extractSysctls(scc *securityapi.SecurityContextConstraints, annotations map
 		annotations[internalextensions.SysctlsPodSecurityPolicyAnnotationKey] = sysctls
 	}
 }
+
+// PSP doesn't have priority like SCC does. We hold the value of SCC.Priroty field in a custom annotation.
+func extractPriority(scc *securityapi.SecurityContextConstraints, annotations map[string]string) {
+	if scc.Priority != nil {
+		annotations[pspPriorityAnnotationKey] = fmt.Sprintf("%d", *scc.Priority)
+	}
+}

pkg/oc/admin/migrate/scc/scc_to_psp_test.go

@@ -1,6 +1,7 @@
 package scc
 
 import (
+	"fmt"
 	"reflect"
 	"testing"
 
@@ -572,3 +573,23 @@ func TestExtractSysctls(t *testing.T) {
 		t.Errorf("extractSysctls() expected annotation %q to be %q but it has value %q", sysctlsAnnotation, expected, actual)
 	}
 }
+
+func TestExtractPriority(t *testing.T) {
+	var priority int32 = 10
+	expected := fmt.Sprintf("%d", priority)
+	scc := &securityapi.SecurityContextConstraints{
+		Priority: &priority,
+	}
+
+	annotations := make(map[string]string)
+	extractPriority(scc, annotations)
+
+	value, hasAnnotation := annotations[pspPriorityAnnotationKey]
+	if !hasAnnotation {
+		t.Fatalf("expected to have annotation %q but it is not set", pspPriorityAnnotationKey)
+	}
+
+	if value != expected {
+		t.Errorf("expected annotation %q to have value \"%v\" but it has value \"%v\"", pspPriorityAnnotationKey, expected, value)
+	}
+}