Date: 2023-05-30
Accepted
A default service account must be provided to allow Konflux components to run pipelines.
While OpenShift Pipelines has the option to automatically create a pipeline ServiceAccount on any namespace, the permissions granted to the account are overly broad and the solution was rejected after a security review.
Therefore Konflux must manage this default service account.
Konflux will provide a service account named appstudio-pipeline.
The Pipeline Service component owns the appstudio-pipeline-scc ClusterRole.
The CodeReadyToolchain is in charge of:
appstudio-pipeline ServiceAccount on all tenant namespaces,appstudio-pipeline-runner ClusterRole,appstudio-pipeline-runner and appstudio-pipeline-scc ClusterRoles to the appstudio-pipeline ServiceAccount.The resource is defined here.
The resource is defined here.
pipeline service account must migrate to the new appstudio-pipeline ServiceAccount.