Reserve /tekton/ paths and "tekton-internal-" volume names

[imjasonh]

Reserve /tekton/ paths and "tekton-internal-" volume names

This prevents collisions between user-specified volumes and
Tekton-internal volumes used to support execution.

Some validation changes:

• volume names starting with "tekton-internal-" are not valid
• volumeMounts that mount at /tekton/* are not valid -- except for /tekton/home, which we allow users to mount over, for instance if they want a PVC volume to persist the default home directory.

Tekton's own internal volume mounts are already mounted at /tekton/*,
and now all volume names start with "tekton-internal-"

Some Tekton-internal volume names were previously randomized to prevent
collisions, which is no longer necessary, so they're no longer
randomized.

creds-init mounts annotated K8s secrets into the creds-init process.
Previously those were mounted at /var/build-secrets/* (a relic of
knative/build times). Now those are mounted at /tekton/creds-secrets/*

Some init container names were also randomly generated, which is
unnecessary, so that's gone too.

/hold
dependent of #1700

Fixes #1304

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

• Includes tests (if functionality changed/added)
• Includes docs (if user facing)
• Commit messages follow commit message best practices

See the contribution guide for more details.

Double check this list of stuff that's easy to miss:

• If you are adding a new binary/image to the cmd dir, please update
  the release Task to build and release this image.

Reviewer Notes

If API changes are included, additive changes must be approved by at least two OWNERS and backwards incompatible changes must be approved by more than 50% of the OWNERS, and they must first be added in a backwards compatible way.

Release Notes

Reject volune names starting with "tekton-internal-" and volume mounts mounting under /tekton/* -- these are reserved for Tekton internal implementation details.

[tekton-robot]

The following is the coverage report on pkg/.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/pipeline/v1alpha1/task_validation.go	81.2%	81.8%	0.5

[vdemeester]

@imjasonh needs a rebase 👼 🙏

[tekton-robot]

The following is the coverage report on pkg/.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/pipeline/v1alpha1/task_validation.go	81.2%	81.8%	0.5

[vdemeester]

#1700 is merged, so I think we can remove the hold

/hold cancel
/retest

[imjasonh]

Tests currently fail because we had previously allowed users to define their own /workspace and HOME volume, in case they wanted those to be persistent for instance.

I think that just means we need to keep allowing those to be mounted over, but not fully-internal paths like /tekton/scripts.

I'll try to fix this up today or tomorrow.

[ghost]

/lgtm

[ghost]

/lgtm

[ghost]

/lgtm

[vdemeester]

/lgtm

[tekton-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: vdemeester

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [vdemeester]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment