Add SecurityContext to Eventlistener containers #1494
Conversation
tekton-robot
added
release-note
tekton-robot
added
release-note-action-required
|
/assign @savitaashture @khrm |
|
shall we take input from EL spec 🤔 |
|
@savitaashture this changes ensures the container always runs as non-root. Do you have a use case for why someone might want it differently? If openshift or another platform does need it to be customized then yeah we could add it but I like the simplicity of always ensuring the EL container with the same security context |
|
Nice, LGTM |
|
@savitaashture @khrm could you please take a look? 🙏 |
The security context is the same one that is applied to other Tekton workloads such as the Triggers and Pipeline controller pods. Eventlisteners already run as non-root, non-privileged containers. Adding this setting allows them to run in environments with pod security admission set to "restricted" (such as the tekton-pipelines namespace) Fixes tektoncd#1490 Signed-off-by: Dibyo Mukherjee <[email protected]>
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: savitaashture The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
tekton-robot
added
the
approved
|
/test pull-tekton-triggers-integration-tests |
Changes
The security context is the same one that is applied to other Tekton workloads such as the Triggers and Pipeline controller pods. Eventlisteners already run as non-root, non-privileged containers. Adding this setting allows them to run in environments with pod security admission set to "restricted" (such as the tekton-pipelines namespace)
Fixes #1490
Submitter Checklist
These are the criteria that every PR should meet, please check them off as you
review them:
See the contribution guide for more details.
Release Notes
/kind bug