You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The default configuration of OpenShift Pipelines 1.3.x and later versions does not allow you to run pods with privileged security context, if the pods result from pipeline run or task run.
10
+
For such pods, the default service account is `pipeline`, and the security context constraint (SCC) associated with the `pipelines` service account is `pipelines-scc`. The `pipelines-scc` SCC is similar to the `anyuid` SCC, but with a minor difference as defined in the YAML file for the SCC of pipelines:
11
+
12
+
.Example `SecurityContextConstraints` object
13
+
[source,yaml,subs="attributes+"]
14
+
----
15
+
apiVersion: security.openshift.io/v1
16
+
kind: SecurityContextConstraints
17
+
...
18
+
fsGroup:
19
+
type: MustRunAs
20
+
...
21
+
----
22
+
23
+
In addition, the `Buildah` cluster task, shipped as part of the OpenShift Pipelines, uses `vfs` as the default storage driver.
* For information on managing SCCs, refer to xref:../../authentication/managing-security-context-constraints.adoc[Managing security context constraints].
Copy file name to clipboardExpand all lines: modules/op-release-notes-1-4.adoc
+15-4Lines changed: 15 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -89,7 +89,7 @@ Support for `when` expressions and `finally` tasks are unavailable in the {produ
89
89
90
90
* The `pipelines-scc` Security Context Constraint (SCC) is used with the default `pipeline` service account for pipelines. This new service account is similar to `anyuid`, but with a minor difference as defined in the YAML for SCC of {product-title} 4.7:
91
91
+
92
-
[source, YAML]
92
+
[source,yaml,subs="attributes+"]
93
93
----
94
94
fsGroup:
95
95
type: MustRunAs
@@ -106,7 +106,12 @@ fsGroup:
106
106
107
107
* The `creds-init` helper image for building and deploying is removed.
108
108
109
-
* In the triggers spec and binding, the deprecated field `template.Name` is removed in favor of `template.Ref`.
109
+
* In the triggers spec and binding, the deprecated field `template.name` is removed in favor of `template.ref`. You should update all `eventListener` definitions to use the `ref` field.
110
+
+
111
+
[NOTE]
112
+
====
113
+
Upgrade from {pipelines-shortname} 1.3.x and earlier versions to {pipelines-shortname} 1.4.0 breaks event listeners because of the unavailability of the `template.name` field. For such cases, use {pipelines-shortname} 1.4.1 to avail the restored `template.name` field.
114
+
====
110
115
111
116
* For `EventListener` custom resources/objects, the fields `PodTemplate` and `ServiceType` are deprecated in favor of `Resource`.
112
117
@@ -128,7 +133,7 @@ fsGroup:
128
133
129
134
* Triggers throw error resulting from bad handling of the JSON format, if you have the following configuration in the trigger binding:
130
135
+
131
-
[source, YAML]
136
+
[source,yaml,subs="attributes+"]
132
137
----
133
138
params:
134
139
- name: github_json
@@ -138,12 +143,14 @@ To resolve the issue:
138
143
** If you are using triggers v0.11.0 and above, use the `marshalJSON` CEL function, which takes a JSON object or array and returns the JSON encoding of that object or array as a string.
139
144
** If you are using older triggers version, add the following annotation in the trigger template:
140
145
+
141
-
[source, YAML]
146
+
[source,yaml,subs="attributes+"]
142
147
----
143
148
annotations:
144
149
triggers.tekton.dev/old-escape-quotes: "true"
145
150
----
146
151
152
+
* When upgrading from {pipelines-shortname} 1.3.x to 1.4.x, you must recreate the routes.
153
+
147
154
[id="fixed-issues-1-4_{context}"]
148
155
== Fixed issues
149
156
@@ -186,3 +193,7 @@ annotations:
186
193
* Previously, a pipeline result that contained an invalid variable would be added to the pipeline run with the literal expression of the variable intact. Therefore, it was difficult to assess whether the results were populated correctly. This issue is fixed by filtering out the pipeline run results that reference failed task runs. Now, a pipeline result that contains an invalid variable will not be emitted by the pipeline run at all.
187
194
188
195
* The `tkn eventlistener describe` command is fixed to avoid crashing without a template. It also displays the details about trigger references.
196
+
197
+
* Upgrades from {pipelines-shortname} 1.3.x and earlier versions to {pipelines-shortname} 1.4.0 breaks event listeners because of the unavailability of `template.name`. In {pipelines-shortname} 1.4.1, the `template.name` has been restored to avoid breaking event listeners in triggers.
198
+
199
+
* In {pipelines-shortname} 1.4.1, the `ConsoleQuickStart` custom resource has been updated to align with {product-title} 4.7 capabilities and behavior.
To run a pod (resulting from pipeline run or task run) with the `privileged` security context, do the following modifications:
10
+
11
+
* Configure the associated user account or service account to have an explicit SCC. You can perform the configuration using any of the following methods:
** Alternatively, modify the YAML files for `RoleBinding`, and `Role` or `ClusterRole`:
19
+
20
+
+
21
+
.Example `RoleBinding` object
22
+
[source,yaml,subs="attributes+"]
23
+
----
24
+
apiVersion: rbac.authorization.k8s.io/v1
25
+
kind: RoleBinding
26
+
metadata:
27
+
name: service-account-name <1>
28
+
namespace: default
29
+
roleRef:
30
+
apiGroup: rbac.authorization.k8s.io
31
+
kind: ClusterRole
32
+
name: pipelines-scc-clusterrole <2>
33
+
subjects:
34
+
- kind: ServiceAccount
35
+
name: pipeline
36
+
namespace: default
37
+
38
+
----
39
+
<1> Substitute with an appropriate service account name.
40
+
<2> Substitute with an appropriate cluster role based on the role binding you use.
41
+
42
+
+
43
+
.Example `ClusterRole` object
44
+
[source,yaml,subs="attributes+"]
45
+
----
46
+
apiVersion: rbac.authorization.k8s.io/v1
47
+
kind: ClusterRole
48
+
metadata:
49
+
name: pipelines-scc-clusterrole <1>
50
+
rules:
51
+
- apiGroups:
52
+
- security.openshift.io
53
+
resourceNames:
54
+
- nonroot
55
+
resources:
56
+
- securitycontextconstraints
57
+
verbs:
58
+
- use
59
+
----
60
+
<1> Substitute with an appropriate cluster role based on the role binding you use.
61
+
62
+
+
63
+
[NOTE]
64
+
====
65
+
As a best practice, create a copy of the default YAML files and make changes in the duplicate file.
66
+
====
67
+
+
68
+
69
+
* If you do not use the `vfs` storage driver, configure the service account associated with the task run or the pipeline run to have a privileged SCC, and set the security context as `privileged: true`.
0 commit comments