feat(buildah): Only request extra security context capabilities on OpenShift
@@ -280,6 +280,20 @@ func (t *builderTrait) buildahTask(e *Environment) (*v1.ImageTask, error) {
args = append([]string{auth}, args...)
}
+ var sc *corev1.SecurityContext
+ if e.Platform.Status.Cluster == v1.IntegrationPlatformClusterOpenShift {
+ // This requires the builder service account to have privileged SCC on OpenShift
+ // It should be removed when Buildah fully supports unprivileged build
+ sc = &corev1.SecurityContext{
+ Capabilities: &corev1.Capabilities{
+ Add: []corev1.Capability{
+ "SETGID",
+ "SETUID",
+ },
+ },
+ }
+ }
+
return &v1.ImageTask{
ContainerTask: v1.ContainerTask{
BaseTask: v1.BaseTask{
@@ -292,16 +306,7 @@ func (t *builderTrait) buildahTask(e *Environment) (*v1.ImageTask, error) {
Args: []string{strings.Join(args, " && ")},
Env: env,
WorkingDir: path.Join(builderDir, e.IntegrationKit.Name, "context"),
- // This requires the builder service account to have privileged SCC on OpenShift
- // It should be removed when Buildah fully supports unprivileged build
- SecurityContext: &corev1.SecurityContext{
- Capabilities: &corev1.Capabilities{
- Add: []corev1.Capability{
- "SETGID",
- "SETUID",
- },
- },
- },
+ SecurityContext: sc,
},
BuiltImage: image,
}, nil
