Date: 2023-05-30
Accepted
A default service account must be provided to allow Konflux components to run pipelines.
While OpenShift Pipelines has the option to automatically create a pipeline ServiceAccount on any namespace, the permissions granted to the account are overly broad and the solution was rejected after a security review.
Therefore Konflux must manage this default service account.
Konflux will provide a service account named appstudio-pipeline.
The Pipeline Service component owns the appstudio-pipeline-scc ClusterRole.
The CodeReadyToolchain is in charge of:
- creating the
appstudio-pipelineServiceAccount on all tenant namespaces, - creating the
appstudio-pipeline-runnerClusterRole, - granting the
appstudio-pipeline-runnerandappstudio-pipeline-sccClusterRoles to theappstudio-pipelineServiceAccount.
The resource is defined here.
The resource is defined here.
- Tekton Pipelines users using the
pipelineservice account must migrate to the newappstudio-pipelineServiceAccount.