如何为Tekton EventListener配置securityContext？遇PodSecurity报错

问题详情 #

能否为Tekton EventListener配置securityContext？官方文档中未找到相关配置说明，部署后EventListener组件无法正常运行，Pod状态报错如下：

Message:               pods "el-github-listener-interceptor-7b89d546dd-m6rdz" is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "event-listener" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "event-listener" must set securityContext.capabilities.drop=["ALL"]), seccompProfile (pod or container "event-listener" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

当前使用的EventListener定义：

apiVersion: triggers.tekton.dev/v1beta1
kind: EventListener
metadata:
  name: github-listener-interceptor
  namespace: tekton-pipelines
spec:
  serviceAccountName: sa-tekton-triggers
  triggers:
    - name: github-listener
      interceptors:
        - ref:
            name: "github"
          params:
            - name: "eventTypes"
              value: ["push"]
        - ref:
            name: cel
          params:
          - name: filter
            # execute only when ....
            value: extensions.changed_files.matches('src/')
      bindings:
        - ref: pipeline-reach-dashboard-binding
      template:
        ref: pipeline-reach-dashboard-template

已尝试在所有可能的位置添加securityContext配置块，但均未生效。

临时解决方法 #

经确认，这是Tekton Pipelines的已知问题，临时解决方法为：将EventListener及关联的触发器资源迁移至tekton-pipelines命名空间以外的其他命名空间。

内容的提问来源于stack exchange，提问作者Gary Turner