search

tektoncd / pipeline

A cloud-native Pipeline resource.
https://tekton.dev
Apache License 2.0
8.48k stars 1.78k forks source link

Add new feature flag to set readOnlyRootFilesystem for pipelinerun, taskrun and Affinity assistants containers #8183

Open kristofferchr opened 2 months ago

kristofferchr commented 2 months ago

Feature request

Add a flag to enable setting the readOnlyRootFilesystem field in the securityContext for containers used in pipelinerun and taskrun.

Use case

Containers for taskrun and pipelinerun should follow security best practices by setting the readOnlyRootFilesystem field. This practice, recommended by platforms like Azure Kubernetes Service (AKS), enhances container security.

Implementation:

Introduce feature flag set-security-context-read-only-root-filesystem in ConfigMap feature-flags that sets readOnlyRootFilesystem field for all initcontainers and affinity assistant. This should only be applied when feature set-security-context is enabled.

kristofferchr commented 2 months ago

/assign