shell-image should specify to run as root when it needs it.

[mattmoor]

Expected Behavior

A default nonroot version of shell-image can pass e2e testing without issues.

Actual Behavior

permission denied setting up PVCs.

@imjasonh brought up a great point about the script: semantics as well, which are probably being run as root due to the choice of default user today, but I have not confirmed.

Steps to Reproduce the Problem

Replace the -shell-image in config/controller.yaml with ghcr.io/distroless/busybox (which is nonroot by default).

[mattmoor]

FYI this is the shell-image equivalent to: #4711

[mattmoor]

Ultimately the goal of this issue is to weaken this wording where root is required:

The shell image must be root in order to create directories and copy files to PVCs.

... to wording where the image must support running as root.

[mattmoor]

One of the places that must be fixed up is here:

pipeline/pkg/apis/resource/v1alpha1/storage/artifact_pvc.go

Lines 66 to 80 in 80f9ac6

	return []v1beta1.Step{{Container: corev1.Container{
	Name: names.SimpleNameGenerator.RestrictLengthWithRandomSuffix(fmt.Sprintf("source-mkdir-%s", name)),
	Image: p.ShellImage,
	Command: []string{"mkdir", "-p", destinationPath},
	VolumeMounts: []corev1.VolumeMount{GetPvcMount(p.Name)},
	}}, {Container: corev1.Container{
	Name: names.SimpleNameGenerator.RestrictLengthWithRandomSuffix(fmt.Sprintf("source-copy-%s", name)),
	Image: p.ShellImage,
	Command: []string{"cp", "-r", fmt.Sprintf("%s/.", sourcePath), destinationPath},
	VolumeMounts: []corev1.VolumeMount{GetPvcMount(p.Name)},
	Env: []corev1.EnvVar{{
	Name: "TEKTON_RESOURCE_NAME",
	Value: name,
	}},
	}}}

Clearly (from the comment) this code dealing with PVCs is one of the key places where the root requirement had originally stemmed from. I will see if/what else fails when these have an explicit runAsUser: 0 🤞