Fixes for running on k8s 1.23 and restricted PodSecurityAdmission level #1477
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
tekton-robot
added
the
release-note
tekton-robot
added
the
size/XS
This commit updates our plumbing dependency to pull in tektoncd/plumbing#1251 which updates the GKE image to cos_containerd. The older cos image is no longer supported as of GKE v1.23. Part of tektoncd#1475 Signed-off-by: Dibyo Mukherjee <[email protected]>
tekton-robot
added
size/S
2 tasks
|
Running into PSP issues: |
tekton-robot
added
size/L
dibyom
changed the title
This commit drops the Triggers PodSecurityPolicy since its deprecated and is going to be removed in Kubernetes 1.25 in favor of PodSecurityAdmission. In addition, it adds the `securityContext` required for the "restricted" PodSecurityAdmission levels. These changes are necessary for Triggers to work with Pipelines v0.41 and higher because tektoncd/pipeline#5652 started enforcing the restricted pod security level for all pods in the `tekton-pipelines` namespace (which includes the triggers controller, webhook, and core interceptor deployments). Fixes tektoncd#1447 and required for tektoncd#1475 Signed-off-by: Dibyo Mukherjee <[email protected]>
4 tasks
savitaashture
approved these changes
Nov 4, 2022
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: savitaashture The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
tekton-robot
added
the
approved
|
@dibyom I apologize if this is the wrong place to provide feedback on this ticket, but I'm still getting this error on k8s v1.24, pipelines v0.42 and triggers v0.22 (I can confirm that |
|
@seunggs are you running an eventlistener in the tekton-pipelines namespace? |
|
@dibyom Yes, |
|
ok - a quick workaround will be to run your EL in a different namespace till we add a fix |
|
@dibyom thanks - I've just changed the tekton-pipelines namespace setting: |
thanks for the prompt replies @dibyom, my temp solution is to set |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Changes
There are two commits which are both required for Triggers to work with Pipelines v0.41 which requires Kubernetes 1.23.
This commit updates our plumbing dependency to pull in tektoncd/plumbing#1251 which updates the GKE image to cos_containerd. The older cos image is no longer supported as of GKE v1.23.
Part of #1475
This commit drops the Triggers PodSecurityPolicy since its deprecated and is
going to be removed in Kubernetes 1.25 in favor of PodSecurityAdmission.
In addition, it adds the
securityContextrequired for the "restricted"PodSecurityAdmission levels. These changes are necessary for Triggers to work
with Pipelines v0.41 and higher because tektoncd/pipeline#5652 started
enforcing the restricted pod security level for all pods in the
tekton-pipelinesnamespace (which includes the triggers controller, webhook,and core interceptor deployments).
Fixes #1447 and required for #1475
Submitter Checklist
These are the criteria that every PR should meet, please check them off as you
review them:
See the contribution guide for more details.
Release Notes