Ability to Specify PodTemplate for PipelineTasks

[danielhelfand]

Expected Behavior

I would like the ability to specify a PodTemplate for PipelineTasks. Since TaskRuns/PipelineRuns are the only way to specify a PodTemplate to use, there isn't a way to specify different PodTemplates for TaskRuns that are part of a PipelineRun.

An example use case would be wanting some TaskRuns to not allow any containers to run as root via a securityContext. But another TaskRun as part of a PipelineRun may need those elevated privileges to, for instance, build a container image. In this particular case, it would be nice to have the ability to specify this at the Step level, but that doesn't appear to work as of now as documented in #2179. However, there are several more use cases for wanting a different PodTemplate for one TaskRun versus another as part of a PipelineRun

Actual Behavior

A PodTemplate can only be applied for all TaskRuns part of a PipelineRun. There is no property on the PipelineTask to specify a PodTemplate to use for a PipelineTask.

pipeline/pkg/apis/pipeline/v1beta1/pipeline_types.go

Line 91 in c11c6af

type PipelineTask struct {

Additional Info

The thought process behind adding this to the PipelineTask is similar to the issue with wanting different Timeouts for TaskRuns as documented in #1568.

/kind feature

[vdemeester]

@danielhelfand I think this is related to #2362 (and #2389 fixing it), am I right ?

[danielhelfand]

I think what is being added in #2389 is a valid use case and certainly does address why I originally opened this issue, but I wonder about it with regard to client projects like the CLI/dashboard as far as being able to support adding all that information at run time. It's just not the best approach for something like tkn pipeline start for instance in my opinion.

I wonder how much PipelineTasks should actually exactly align with the TaskRun spec? This way, users would have the ability to define directly on a PipelineRun as well as in a Pipeline itself. I could see both use cases being valid from a user experience standpoint. I personally try to avoid the use of PipelineRun objects directly.

[danielhelfand]

Closing this. I have rethought this and think we that #2362 should allow some options to develop around to not need PipelineTasks to support this. However, it may be something to consider to allow these properties to be directly defined on PipelineTasks in the future.