As of today, the OpenShift Pipelines operator will create a pipeline service account on all namespace when installed, with the pipeline-scc which has RunAsAny among other things.

Why

This feature can be seen as a security issue as some customers have reported. It would be interesting if a cluster-admin could disable this feature by default.

This has some impact though : our ClusterTask would note work by default anymore. This has to be clear to the user that when he disables this, either it also disable default cluster task or they are expected to not work. This would require heavy documentation on our part (in a "use case" part of our documentation)

Acceptance Criteria

• As a cluster-admin, I can disable the creation of the default pipeline service account on each namespace.