Skip to content

Commit b86a9a2

Browse files
Scotttekton-robot
Scott
authored and
tekton-robot
committed
Disable the default workingDir and HOME overrides
Prior to this commit Steps were given a default HOME env var and a default workingDir. These defaults collide with any value set by the Step's image Dockerfile. This commit removes the default home and workingDir overrides (except in those few cases where they're still expected, like PipelineResources). See https://groups.google.com/g/tekton-dev/c/C-PL8VYN51E/m/el5Fca_PDAAJ for our tekton-dev announcement of this change. See tektoncd#1836 for the original problem description and workingDir tracking issue. See tektoncd#2013 for the HOME change tracking issue. See https://github.com/tektoncd/pipeline/blob/main/docs/deprecations.md for our documented dates for these deprecations. See https://github.com/tektoncd/pipeline/blob/main/api_compatibility_policy.md#alpha-beta-and-ga for our beta deprecation policy. ,
1 parent ea9158f commit b86a9a2

24 files changed

+148
-138
lines changed

‎config/config-feature-flags.yaml

+5-13
Original file line numberDiff line numberDiff line change
@@ -30,26 +30,18 @@ data:
3030
# https://github.com/tektoncd/pipeline/blob/main/docs/workspaces.md#affinity-assistant-and-specifying-workspace-order-in-a-pipeline
3131
# or https://github.com/tektoncd/pipeline/pull/2630 for more info.
3232
disable-affinity-assistant: "false"
33-
# Setting this flag to "true" will prevent Tekton overriding your
33+
# Setting this flag to "false" will allow Tekton to override your
3434
# Task container's $HOME environment variable.
3535
#
36-
# The default behaviour currently is for Tekton to override the
37-
# $HOME environment variable but this will change in an upcoming
38-
# release.
39-
#
4036
# See https://github.com/tektoncd/pipeline/issues/2013 for more
4137
# info.
42-
disable-home-env-overwrite: "false"
43-
# Setting this flag to "true" will prevent Tekton overriding your
38+
disable-home-env-overwrite: "true"
39+
# Setting this flag to "false" will allow Tekton to override your
4440
# Task container's working directory.
4541
#
46-
# The default behaviour currently is for Tekton to override the
47-
# working directory if not set by the user but this will change
48-
# in an upcoming release.
49-
#
5042
# See https://github.com/tektoncd/pipeline/issues/1836 for more
5143
# info.
52-
disable-working-directory-overwrite: "false"
44+
disable-working-directory-overwrite: "true"
5345
# Setting this flag to "true" will prevent Tekton scanning attached
5446
# service accounts and injecting any credentials it finds into your
5547
# Steps.
@@ -61,7 +53,7 @@ data:
6153
# Note: setting this to "true" will prevent PipelineResources from
6254
# working.
6355
#
64-
# See https://github.com/tektoncd/pipeline/issues/1836 for more
56+
# See https://github.com/tektoncd/pipeline/issues/2791 for more
6557
# info.
6658
disable-creds-init: "false"
6759
# This option should be set to false when Pipelines is running in a

‎docs/deprecations.md

+3-4
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
21
<!--
32
---
43
linkTitle: "Deprecations"
@@ -21,9 +20,9 @@ being deprecated.
2120
| Feature Being Deprecated | Deprecation Announcement | [API Compatibility Policy](https://github.com/tektoncd/pipeline/tree/main/api_compatibility_policy.md) | Earliest Date or Release of Removal |
2221
| ------------------------ | ------------------------ | -------------------------------------------------------------------------------------------------------- | ------------------------ |
2322
| [`tekton.dev/task` label on ClusterTasks](https://github.com/tektoncd/pipeline/issues/2533) | [v0.12.0](https://github.com/tektoncd/pipeline/releases/tag/v0.12.0) | Beta | January 30 2021 |
24-
| [Step `$HOME` env var defaults to `/tekton/home`](https://github.com/tektoncd/pipeline/issues/2013) | [v0.11.0-rc1](https://github.com/tektoncd/pipeline/releases/tag/v0.11.0-rc1) | Beta | December 4 2020 |
25-
| [Step `workingDir` defaults to `/workspace`](https://github.com/tektoncd/pipeline/issues/1836) | [v0.11.0-rc1](https://github.com/tektoncd/pipeline/releases/tag/v0.11.0-rc1) | Beta | December 4 2020 |
2623
| [The `TaskRun.Status.ResourceResults.ResourceRef` field is deprecated and will be removed.](https://github.com/tektoncd/pipeline/issues/2694) | [v0.14.0](https://github.com/tektoncd/pipeline/releases/tag/v0.14.0) | Beta | April 30 2021 |
2724
| [The `PipelineRun.Spec.ServiceAccountNames` field is deprecated and will be removed.](https://github.com/tektoncd/pipeline/issues/2614) | [v0.15.0](https://github.com/tektoncd/pipeline/releases/tag/v0.15.0) | Beta | May 15 2021 |
2825
| [`Conditions` CRD is deprecated and will be removed. Use `WhenExpressions` instead.](https://github.com/tektoncd/community/blob/main/teps/0007-conditions-beta.md) | [v0.16.0](https://github.com/tektoncd/pipeline/releases/tag/v0.16.0) | Alpha | Nov 02 2020 |
29-
| [The PascalCase fields in WhenExpressions is deprecated and will be removed](https://github.com/tektoncd/pipeline/pull/3389) | [v0.17.2](https://github.com/tektoncd/pipeline/releases/tag/v0.17.2) | Alpha | Jan 07 2021 |
26+
| [The PascalCase fields in WhenExpressions is deprecated and will be removed](https://github.com/tektoncd/pipeline/pull/3389) | [v0.17.2](https://github.com/tektoncd/pipeline/releases/tag/v0.17.2) | Alpha | Jan 07 2021 |
27+
| [The `disable-home-env-overwrite` flag will be removed](https://github.com/tektoncd/pipeline/issues/2013) | [v0.24.0](https://github.com/tektoncd/pipeline/releases/tag/v0.24.0) | Beta | February 10 2022 |
28+
| [The `disable-working-dir-overwrite` flag will be removed](https://github.com/tektoncd/pipeline/issues/1836) | [v0.24.0](https://github.com/tektoncd/pipeline/releases/tag/v0.24.0) | Beta | February 10 2022 |

‎docs/install.md

+7-9
Original file line numberDiff line numberDiff line change
@@ -320,15 +320,13 @@ To customize the behavior of the Pipelines Controller, modify the ConfigMap `fea
320320
node in the cluster must have an appropriate label matching `topologyKey`. If some or all nodes
321321
are missing the specified `topologyKey` label, it can lead to unintended behavior.
322322

323-
- `disable-home-env-overwrite` - set this flag to `true` to prevent Tekton
324-
from overriding the `$HOME` environment variable for the containers executing your `Steps`.
325-
The default is `false`. For more information, see the [associated issue](https://github.com/tektoncd/pipeline/issues/2013).
326-
327-
- `disable-working-directory-overwrite` - set this flag to `true` to prevent Tekton
328-
from overriding the working directory for the containers executing your `Steps`.
329-
The default value is `false`, which causes Tekton to override the working directory
330-
for each `Step` that does not have its working directory explicitly set with `/workspace`.
331-
For more information, see the [associated issue](https://github.com/tektoncd/pipeline/issues/1836).
323+
- `disable-home-env-overwrite` - set this flag to `false` to allow Tekton
324+
to override the `$HOME` environment variable for the containers executing your `Steps`.
325+
The default is `true`. For more information, see the [associated issue](https://github.com/tektoncd/pipeline/issues/2013).
326+
327+
- `disable-working-directory-overwrite` - set this flag to `false` to allow Tekton
328+
to override the working directory for the containers executing your `Steps`.
329+
The default value is `true`. For more information, see the [associated issue](https://github.com/tektoncd/pipeline/issues/1836).
332330

333331
- `running-in-environment-with-injected-sidecars`: set this flag to `"true"` to allow the
334332
Tekton controller to set the `tekton.dev/ready` annotation at pod creation time for

‎examples/v1alpha1/taskruns/dind-sidecar.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ spec:
1717
# Use the certs generated by the sidecar daemon.
1818
- name: DOCKER_CERT_PATH
1919
value: /certs/client
20+
workingDir: /workspace
2021
script: |
2122
#!/usr/bin/env sh
2223
set -e

‎examples/v1alpha1/taskruns/gcs-resource.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ spec:
1010
type: storage
1111
steps:
1212
- image: alpine
13+
workingDir: /workspace
1314
script: unzip source/archive.zip && cat file.txt
1415
inputs:
1516
resources:

‎examples/v1alpha1/taskruns/git-resource.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ spec:
1010
type: git
1111
steps:
1212
- image: ubuntu
13+
workingDir: /workspace
1314
script: cat skaffold/README.md
1415
inputs:
1516
resources:
@@ -34,6 +35,7 @@ spec:
3435
type: git
3536
steps:
3637
- image: ubuntu
38+
workingDir: /workspace
3739
script: cat skaffold/README.md
3840
inputs:
3941
resources:
@@ -58,6 +60,7 @@ spec:
5860
type: git
5961
steps:
6062
- image: ubuntu
63+
workingDir: /workspace
6164
script: cat skaffold/README.md
6265
inputs:
6366
resources:
@@ -83,6 +86,7 @@ spec:
8386
type: git
8487
steps:
8588
- image: ubuntu
89+
workingDir: /workspace
8690
script: cat skaffold/README.md
8791
inputs:
8892
resources:
@@ -110,6 +114,7 @@ spec:
110114
type: git
111115
steps:
112116
- image: ubuntu
117+
workingDir: /workspace
113118
script: cat skaffold/README.md
114119
inputs:
115120
resources:

‎examples/v1alpha1/taskruns/home-is-set.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ spec:
66
taskSpec:
77
steps:
88
- image: ubuntu
9+
env:
10+
- name: HOME
11+
value: /tekton/home
912
script: |
1013
#!/usr/bin/env bash
1114
[[ $HOME == /tekton/home ]]

‎examples/v1alpha1/taskruns/step-script.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ spec:
5151
image: ubuntu
5252
securityContext:
5353
runAsUser: 16000
54+
workingDir: /workspace
5455
script: |
5556
#!/usr/bin/env bash
5657
cat > file << EOF

‎examples/v1alpha1/taskruns/workingdir.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ spec:
77
steps:
88
- name: default
99
image: ubuntu
10+
workingDir: /workspace
1011
script: |
1112
#!/usr/bin/env bash
1213
[[ $PWD == /workspace ]]

‎examples/v1beta1/taskruns/alpha/authenticating-git-commands.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -193,7 +193,7 @@ spec:
193193
# When disable-home-env-overwrite is "true", creds-init credentials
194194
# will be copied to /home/nonroot/.ssh by the entrypoint. We just need to
195195
# overwrite the known_hosts file with that of our test git server.
196-
cp /messages/known_hosts /home/nonroot/ssh/known_hosts
196+
cp /messages/known_hosts /home/nonroot/.ssh/known_hosts
197197
fi
198198
199199
git clone root@localhost:/root/repo ./repo

‎examples/v1beta1/taskruns/authenticating-git-commands.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -201,7 +201,7 @@ spec:
201201
# When disable-home-env-overwrite is "true", creds-init credentials
202202
# will be copied to /home/nonroot/.ssh by the entrypoint. We just need to
203203
# overwrite the known_hosts file with that of our test git server.
204-
cp /messages/known_hosts /home/nonroot/ssh/known_hosts
204+
cp /messages/known_hosts /home/nonroot/.ssh/known_hosts
205205
fi
206206
207207
git clone root@localhost:/root/repo ./repo

‎examples/v1beta1/taskruns/dind-sidecar.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ spec:
1717
# Use the certs generated by the sidecar daemon.
1818
- name: DOCKER_CERT_PATH
1919
value: /certs/client
20+
workingDir: /workspace
2021
script: |
2122
#!/usr/bin/env sh
2223
set -e

‎examples/v1beta1/taskruns/gcs-resource.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ spec:
1010
type: storage
1111
steps:
1212
- image: alpine
13+
workingDir: /workspace
1314
script: unzip source/archive.zip && cat file.txt
1415
resources:
1516
inputs:

‎examples/v1beta1/taskruns/git-resource.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ spec:
1010
type: git
1111
steps:
1212
- image: ubuntu
13+
workingDir: /workspace
1314
script: cat skaffold/README.md
1415
resources:
1516
inputs:
@@ -34,6 +35,7 @@ spec:
3435
type: git
3536
steps:
3637
- image: ubuntu
38+
workingDir: /workspace
3739
script: cat skaffold/README.md
3840
resources:
3941
inputs:
@@ -58,6 +60,7 @@ spec:
5860
type: git
5961
steps:
6062
- image: ubuntu
63+
workingDir: /workspace
6164
script: cat skaffold/README.md
6265
resources:
6366
inputs:

‎examples/v1beta1/taskruns/home-is-set.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ spec:
66
taskSpec:
77
steps:
88
- image: ubuntu
9+
env:
10+
- name: HOME
11+
value: /tekton/home
912
script: |
1013
#!/usr/bin/env bash
1114
[[ $HOME == /tekton/home ]]

‎examples/v1beta1/taskruns/step-script.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ spec:
5050
image: ubuntu
5151
securityContext:
5252
runAsUser: 16000
53+
workingDir: /workspace
5354
script: |
5455
#!/usr/bin/env bash
5556
cat > file << EOF

‎examples/v1beta1/taskruns/workingdir.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ spec:
77
steps:
88
- name: default
99
image: ubuntu
10+
workingDir: /workspace
1011
script: |
1112
#!/usr/bin/env bash
1213
[[ $PWD == /workspace ]]

‎pkg/apis/config/feature_flags.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,8 @@ const (
3737
enableTektonOCIBundles = "enable-tekton-oci-bundles"
3838
enableCustomTasks = "enable-custom-tasks"
3939
enableAPIFields = "enable-api-fields"
40-
DefaultDisableHomeEnvOverwrite = false
41-
DefaultDisableWorkingDirOverwrite = false
40+
DefaultDisableHomeEnvOverwrite = true
41+
DefaultDisableWorkingDirOverwrite = true
4242
DefaultDisableAffinityAssistant = false
4343
DefaultDisableCredsInit = false
4444
DefaultRunningInEnvWithInjectedSidecars = true

‎pkg/apis/config/feature_flags_test.go

+13-1
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,8 @@ func TestNewFeatureFlagsFromConfigMap(t *testing.T) {
3535
testCases := []testCase{
3636
{
3737
expectedConfig: &config.FeatureFlags{
38+
DisableHomeEnvOverwrite: false,
39+
DisableWorkingDirOverwrite: false,
3840
RunningInEnvWithInjectedSidecars: config.DefaultRunningInEnvWithInjectedSidecars,
3941
EnableAPIFields: "stable",
4042
},
@@ -61,6 +63,8 @@ func TestNewFeatureFlagsFromConfigMap(t *testing.T) {
6163
EnableTektonOCIBundles: true,
6264
EnableCustomTasks: true,
6365

66+
DisableHomeEnvOverwrite: true,
67+
DisableWorkingDirOverwrite: true,
6468
RunningInEnvWithInjectedSidecars: config.DefaultRunningInEnvWithInjectedSidecars,
6569
},
6670
fileName: "feature-flags-enable-api-fields-overrides-bundles-and-custom-tasks",
@@ -71,20 +75,28 @@ func TestNewFeatureFlagsFromConfigMap(t *testing.T) {
7175
EnableTektonOCIBundles: true,
7276
EnableCustomTasks: true,
7377

78+
DisableHomeEnvOverwrite: true,
79+
DisableWorkingDirOverwrite: true,
7480
RunningInEnvWithInjectedSidecars: config.DefaultRunningInEnvWithInjectedSidecars,
7581
},
7682
fileName: "feature-flags-bundles-and-custom-tasks",
7783
},
7884
}
7985

8086
for _, tc := range testCases {
81-
verifyConfigFileWithExpectedFeatureFlagsConfig(t, tc.fileName, tc.expectedConfig)
87+
fileName := tc.fileName
88+
expectedConfig := tc.expectedConfig
89+
t.Run(fileName, func(t *testing.T) {
90+
verifyConfigFileWithExpectedFeatureFlagsConfig(t, fileName, expectedConfig)
91+
})
8292
}
8393
}
8494

8595
func TestNewFeatureFlagsFromEmptyConfigMap(t *testing.T) {
8696
FeatureFlagsConfigEmptyName := "feature-flags-empty"
8797
expectedConfig := &config.FeatureFlags{
98+
DisableHomeEnvOverwrite: true,
99+
DisableWorkingDirOverwrite: true,
88100
RunningInEnvWithInjectedSidecars: true,
89101
EnableAPIFields: "stable",
90102
}

‎pkg/pod/pod.go

+5-3
Original file line numberDiff line numberDiff line change
@@ -161,9 +161,11 @@ func (b *Builder) Build(ctx context.Context, taskRun *v1beta1.TaskRun, taskSpec
161161
// Add implicit env vars.
162162
// They're prepended to the list, so that if the user specified any
163163
// themselves their value takes precedence.
164-
for i, s := range stepContainers {
165-
env := append(implicitEnvVars, s.Env...)
166-
stepContainers[i].Env = env
164+
if len(implicitEnvVars) > 0 {
165+
for i, s := range stepContainers {
166+
env := append(implicitEnvVars, s.Env...)
167+
stepContainers[i].Env = env
168+
}
167169
}
168170

169171
// Add implicit volume mounts to each step, unless the step specifies

0 commit comments

Comments
 (0)