-
Epic
-
Resolution: Unresolved
-
Critical
-
None
-
None
-
None
-
Use Kubernetes user namespaces for buildah pods
-
False
-
None
-
False
-
OCPSTRAT-198Secure-by-default image builds
-
To Do
-
OCPSTRAT-198 - Secure-by-default image builds
-
100% To Do, 0% In Progress, 0% Done
Epic Goal
OpenShift Pipelines uses Kubernetes user namespace instead of CRI-O user namespace in order to run buildah pods in the user namespaces
Why is this important?
To enable any authenticated user on OpenShift to run image builds through OpenShift Pipelines without requiring additional privileges for buildah pods that are not available to all authenticated users and all pods.
Acceptance Criteria
- Buildah pods in Pipelines (e.g. Buildah and S2I Tasks) run in the user namespace using the Kubernetes user namespaces
- Buildah pods in Pipelines can run with the default service account and the user-namespace-aware equivalent of "restricted" SCC
- Image builds with buildah functions without pipeline service account and pipeline-scc
- is blocked by
-
OCPNODE-1266 User namespaces in stateless + statefull pods alpha in 1.28
- Closed