Set runAsUser uid for nonroot distroless image

Port of tektoncd/pipeline#3342: The distroless nonroot image define a user with the uid 65532 and not 1001. The deployment should use that uid to make sure it works anywhere. Fixes #781 Signed-off-by: Dibyo Mukherjee <dibyo@google.com>
tektoncd · Oct 8, 2020 · 09539a8 · 09539a8
1 parent 11b372c
commit 09539a8
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 0 deletions.
diff --git a/config/controller.yaml b/config/controller.yaml
@@ -71,3 +71,7 @@ spec:
           value: config-observability-triggers
         - name: METRICS_DOMAIN
           value: tekton.dev/triggers
+        securityContext:
+          allowPrivilegeEscalation: false
+          # User 65532 is the distroless nonroot user ID
+          runAsUser: 65532
diff --git a/config/webhook.yaml b/config/webhook.yaml
@@ -74,3 +74,7 @@ spec:
           containerPort: 8008
         - name: https-webhook
           containerPort: 8443
+        securityContext:
+          allowPrivilegeEscalation: false
+          # User 65532 is the distroless nonroot user ID
+          runAsUser: 65532