Security Context Constraint issue on OCP 4.7

[ddreggors]

Should there be a note for OCP 4.7 users somewhere to change the pipeline serviceaccount to add privileged scc?

Issue

The follwing step fails:

tkn task start -n tektontutorial build-app \                         
  --inputresource='source=git-source' \
  --outputresource='builtImage=tekton-tutorial-greeter-image' \
  --param contextDir='springboot' \
  --showlog

When it fails it also produces this error in the namespace events:

18m         Warning   InternalError    taskrun/build-app-run-vldj8         1 error occurred:
            * failed to create task run pod "build-app-run-vldj8": pods "build-app-run-vldj8-pod-wtss6" is forbidden: unable to validate against any security context constraint: [spec.containers[3].securityContext.privileged: Invalid value: true: Privileged containers are not allowed spec.containers[4].securityContext.privileged: Invalid value: true: Privileged containers are not allowed spec.containers[3].securityContext.runAsUser: Invalid value: 0: must be in the ranges: [1000660000, 1000669999] spec.containers[3].securityContext.privileged: Invalid value: true: Privileged containers are not allowed spec.containers[4].securityContext.runAsUser: Invalid value: 0: must be in the ranges: [1000660000, 1000669999] spec.containers[4].securityContext.privileged: Invalid value: true: Privileged containers are not allowed spec.containers[3].securityContext.runAsUser: Invalid value: 0: running with the root UID is forbidden spec.containers[3].securityContext.privileged: Invalid value: true: Privileged containers are not allowed spec.containers[4].securityContext.runAsUser: Invalid value: 0: running with the root UID is forbidden spec.containers[4].securityContext.privileged: Invalid value: true: Privileged containers are not allowed]. Maybe missing or invalid Task tektontutorial/build-app

To Reproduce Steps to reproduce the behavior:

1. Preform the TaskRun command above under Build Cloud Native Application
2. Watch screen
3. See error when it fails to Init image due to SCC violation

Expected behavior No security constraint error and image runs as expected.

Suggestions Possibly use a different image that does not require user root (0) or if that image must be used then add a note for OCP 4.7 users to preform the follwing in the tektontutorial namespace...

oc adm policy add-scc-to-user privileged -ntektontutorial -z pipeline

Desktop:

• OS: Fedora Linux
• Version: 33
• Browser: chrome - 90.0.4430.72 (Official Build) (64-bit)
• OpenShift Version:

  Client Version: 4.7.0
  Server Version: 4.7.0
  Kubernetes Version: v1.20.0+bd9e442

• Tekton Version :

  Client version: 0.15.0
  Pipeline version: v0.19.0
  Triggers version: v0.10.2