Run buildah steps without privileged containers

[apoorvajagtap]

Changes

The current Shipwright strategy examples use privileged containers to run buildah.

With the current PR these have been updated to use more limited permissions/capabilities and align with Tekton task for OpenShift pipelines.

Submitter Checklist

• Includes tests if functionality changed/was added
• Includes docs if changes are user-facing
• Set a kind label on this PR
• Release notes block has been filled in, or marked NONE

Release Notes

The BuildAh sample build strategies now do not anymore run privileged containers

[apoorvajagtap]

/assign @adambkaplan @coreydaley

[SaschaSchwarze0]

@apoorvajagtap please set the release note in your PR description.

[apoorvajagtap]

@adambkaplan @coreydaley the buildah_shipwright_managed_push buildstrategy needs an additional capability (along with the one provided with pipelines-scc by default). So, how one should tackle with the SCC alignment with such buildrun pods?
Would it be efficient to update the pipelines-scc to make the required capability available (along with setfcap)?

[SaschaSchwarze0]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: SaschaSchwarze0

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [SaschaSchwarze0]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coreydaley]

@apoorvajagtap I think you just need to add

 - name: storage-driver
      description: "The storage driver to use, such as `overlay` or `vfs`"
      type: string
      default: "vfs"
      # For details see the "--storage-driver" section of https://github.com/containers/buildah/blob/main/docs/buildah.1.md#options

Like you did in the other yamls

[SaschaSchwarze0]

@apoorvajagtap I suggest to remove the change to MinimalBuildahBuildStrategy and leave it like it was. The idea of this build strategy is to be simple. In particular the unit test expects it to have no parameters.

[SaschaSchwarze0]

/lgtm

[apoorvajagtap]

@SaschaSchwarze0 I just want to highlight that the buildstrategy_buildah_shipwright_managed_push will still need the privileged permissions for the container, as it requires DAC_OVERRIDE along with the SETFCAP which isn't provided by default with the pipelines SA. So, should we specify the buildstrategies name in the Release notes? i.e.

The buildah_strategy_managed_push sample build strategy now does not anymore run privileged containers

[SaschaSchwarze0]

/lgtm