Skip to content

Commit

Permalink
Add security context for example PRs using catalog git-clone
Browse files Browse the repository at this point in the history
The newest versions of the git-clone catalog task don't run as root.
Using this task requires setting the pod's security context to allow writes to volumes
from non-root users.
  • Loading branch information
lbernick authored and tekton-robot committed Feb 13, 2023
1 parent 64498c3 commit d4242ed
Show file tree
Hide file tree
Showing 4 changed files with 12 additions and 0 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,9 @@ spec:
pipelineRef:
name: clone-cleanup-workspace
serviceAccountName: 'default'
podTemplate:
securityContext:
fsGroup: 65532 # Make volumes accessible by non-root user for git-clone catalog task
workspaces:
- name: git-source
volumeClaimTemplate:
Expand Down
3 changes: 3 additions & 0 deletions examples/v1beta1/pipelineruns/pipelinerun.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -245,6 +245,9 @@ spec:
pipelineRef:
name: "demo.pipeline"
serviceAccountName: 'default'
podTemplate:
securityContext:
fsGroup: 65532 # Make volumes accessible by non-root user for git-clone catalog task
workspaces:
- name: git-source
volumeClaimTemplate:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -88,6 +88,9 @@ spec:
pipelineRef:
name: clone-cleanup-workspace
serviceAccountName: 'default'
podTemplate:
securityContext:
fsGroup: 65532 # Make volumes accessible by non-root user for git-clone catalog task
workspaces:
- name: git-source
volumeClaimTemplate:
Expand Down
3 changes: 3 additions & 0 deletions test/yamls/v1beta1/pipelineruns/pipelinerun.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -248,6 +248,9 @@ spec:
pipelineRef:
name: demo-pipeline
serviceAccountName: 'default'
podTemplate:
securityContext:
fsGroup: 65532 # Make volumes accessible by non-root user for git-clone catalog task
workspaces:
- name: git-source
volumeClaimTemplate:
Expand Down

0 comments on commit d4242ed

Please sign in to comment.