Grant Tekton additional privileges on OpenShift #384
Conversation
When deploying Tekton on openshift, grant the tekton-pipelines- controller use of the priveleged security context constraint. This will let the Tekton controller create privileged containers. Build strategies such as buildah currently require use of the priveleged SCC. Fixes shipwright-io#378
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/assign @SaschaSchwarze0 |
|
/test 4.4-unit |
|
@adambkaplan this code is vendor-specific. We feel this is not suitable for upstream. We have similar use cases in our service that we handle downstream, like (in the build operator deployment) specifying the number of replicas and the pod anti-affinity rules. If you feel this needs to be in shipwright, then let's maybe discuss it on Monday. |
|
That's fair to not include vendor-specific code. Perhaps we document this as an additional installation step for folks using OKD/OpenShift? |
|
/close This will be addressed in openshift/okd specific documentation. |
|
@adambkaplan: Closed this PR. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
When deploying Tekton on openshift, grant the tekton-pipelines-
controller use of the priveleged security context constraint. This
will let the Tekton controller create privileged containers. Build
strategies such as buildah currently require use of the priveleged SCC.
Fixes #378