tektoncd / chains

Supply Chain Security in Tekton Pipelines
Apache License 2.0
246 stars 129 forks source link

Include the ServiceAccount running a pipeline in the chains provenance #1098

Closed arewm closed 3 months ago

arewm commented 6 months ago

Feature request

Record the service accounts used to run a task in the provenance.

Use case

As multiple Service Accounts may exist in a cluster with varying permissions, the Chains attestation should include the reference to the specific ServiceAccounts which are used to run the tasks. While the service account can be specified on the pipeline level, it should be recorded at a taskrun level as this is the relevant scope.