8000 Release v0.14.2: Revert "Remove creds-init intContainer" · mrtoms/pipeline · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

v0.14.2

tagged this 16 Jul 17:41
This reverts commit bbb767cd8fb3e52ded726ddbbc531745e3fe17c0.

In https://github.com/tektoncd/pipeline/pull/2671 I removed the creds-init
initContainer from Task Pods so that credentials could be used by containers
running with non-root users.  The intention was for this change to be free
of any side-effects to end-users.  Unfortunately a
[backwards incompatible issue](https://github.com/tektoncd/pipeline/issues/2951)
has cropped up with this change:

When a user does not specify the `known_hosts` field in a creds-init Secret,
the credential code will perform an `ssh-keyscan` of the remote server to get
its public key.  The problem is that previously we could guarantee `ssh-keyscan`
was available since the code ran in our own creds-init container with our own
docker image. Since we've now moved that code into Steps' entrypoint the Steps
container is required to provide `ssh-keyscan`.  This is a change in container
contract and therefore backwards-incompatible.

In this PR I've reverted the creds-init change for the 0.14 branch rather than
attempt to fix the `ssh-keyscan` issue and possibly introduce more problems.

Before 0.15 I'd like to get a better backwards-compatible fix organized.
So I plan to leave the creds-init change in place in the `master` branch for
the time being.
Assets 2
Loading
0