Set the scripts dir to readonly after init

[06kellyjac]

Changes

Make the script volume mount read-only for all mounts excluding the init container that creates the scripts

This resolves issue #4160 and prevents overwriting the scripts from subsequent steps leading to anomalous, obscure, or dangerous results.

I made these changes a while ago before the debug scripts volume was added. I added an extra commit to deal with debug scripts too. I've ran the unit tests and I've deployed with ko and done some normal runs (using the tests from catalog) in a k3d cluster but I'm not very familiar with this debug scripts feature so some deeper testing might be necessary.
Edit: the debug scripts need to be written to each step like /tekton/tools with it's post/wait files

/kind bug

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

• Docs included if any changes are user facing
• Tests included if any functionality added or changed
• Follows the commit message standard
• Meets the Tekton contributor standards (including
  functionality, content, code)
• Release notes block below has been filled in or deleted (only if no user facing changes)

Release Notes

Note: I can modify the release-note to "action required" if we think someone might actually be overwriting the scripts in their use of tekton
Their resolution action would be to either an alternative mentioned at the bottom of #4160 or to mount their own volume to write other scripts to

Mount script workspace as readonly

[tekton-robot]

Hi @06kellyjac. Thanks for your PR.

I'm waiting for a tektoncd member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[ghost]

/ok-to-test

/approve

[06kellyjac]

Ok, my unit tests were passing but that was just a cached result 😕

I've dropped the debug scripts part

[vdemeester]

/cc @tektoncd/core-maintainers

[06kellyjac]

/retest

[tekton-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dibyom, sbwsg, vdemeester

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [dibyom,sbwsg,vdemeester]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[wlynch]

/lgtm

[06kellyjac]

I can't at a glance tell what the cause of the failure is. Is this known flakeyness?

[ghost]

Here's the data race log in full:

==================
WARNING: DATA RACE
Read at 0x00c000aa0943 by goroutine 235:
  testing.(*common).logDepth()
      /usr/local/go/src/testing/testing.go:753 +0xa6
  testing.(*common).log()
      /usr/local/go/src/testing/testing.go:746 +0x8f
  testing.(*common).Logf()
      /usr/local/go/src/testing/testing.go:792 +0x21
  testing.(*T).Logf()
      <autogenerated>:1 +0x75
  go.uber.org/zap/zaptest.testingWriter.Write()
      /home/prow/go/src/github.com/tektoncd/pipeline/vendor/go.uber.org/zap/zaptest/logger.go:130 +0x153
  go.uber.org/zap/zaptest.(*testingWriter).Write()
      <autogenerated>:1 +0xad
  go.uber.org/zap/zapcore.(*ioCore).Write()
      /home/prow/go/src/github.com/tektoncd/pipeline/vendor/go.uber.org/zap/zapcore/core.go:90 +0x1e7
  go.uber.org/zap/zapcore.(*CheckedEntry).Write()
      /home/prow/go/src/github.com/tektoncd/pipeline/vendor/go.uber.org/zap/zapcore/entry.go:220 +0x1f1
  go.uber.org/zap.(*SugaredLogger).log()
      /home/prow/go/src/github.com/tektoncd/pipeline/vendor/go.uber.org/zap/sugar.go:227 +0x154
  go.uber.org/zap.(*SugaredLogger).Warnf()
      /home/prow/go/src/github.com/tektoncd/pipeline/vendor/go.uber.org/zap/sugar.go:143 +0x1ab
  github.com/tektoncd/pipeline/pkg/reconciler/taskrun.(*Reconciler).ReconcileKind.func1()
      /home/prow/go/src/github.com/tektoncd/pipeline/pkg/reconciler/taskrun/taskrun.go:144 +0x12b

Previous write at 0x00c000aa0943 by goroutine 250:
  testing.tRunner.func1()
      /usr/local/go/src/testing/testing.go:1180 +0x52c
  testing.tRunner()
      /usr/local/go/src/testing/testing.go:1197 +0x22a

Goroutine 235 (running) created at:
  github.com/tektoncd/pipeline/pkg/reconciler/taskrun.(*Reconciler).ReconcileKind()
      /home/prow/go/src/github.com/tektoncd/pipeline/pkg/reconciler/taskrun/taskrun.go:131 +0x647
  github.com/tektoncd/pipeline/pkg/client/injection/reconciler/pipeline/v1beta1/taskrun.Interface.ReconcileKind-fm()
      /home/prow/go/src/github.com/tektoncd/pipeline/pkg/client/injection/reconciler/pipeline/v1beta1/taskrun/reconciler.go:53 +0x79
  github.com/tektoncd/pipeline/pkg/client/injection/reconciler/pipeline/v1beta1/taskrun.(*reconcilerImpl).Reconcile()
      /home/prow/go/src/github.com/tektoncd/pipeline/pkg/client/injection/reconciler/pipeline/v1beta1/taskrun/reconciler.go:246 +0x18ee
  github.com/tektoncd/pipeline/pkg/reconciler/taskrun.TestReconcileOnCancelledTaskRun()
      /home/prow/go/src/github.com/tektoncd/pipeline/pkg/reconciler/taskrun/taskrun_test.go:2212 +0x1353
  testing.tRunner()
      /usr/local/go/src/testing/testing.go:1193 +0x202

Goroutine 250 (running) created at:
  testing.(*T).Run()
      /usr/local/go/src/testing/testing.go:1238 +0x5d7
  testing.runTests.func1()
      /usr/local/go/src/testing/testing.go:1511 +0xa6
  testing.tRunner()
      /usr/local/go/src/testing/testing.go:1193 +0x202
  testing.runTests()
      /usr/local/go/src/testing/testing.go:1509 +0x612
  testing.(*M).Run()
      /usr/local/go/src/testing/testing.go:1417 +0x3b3
  main.main()
      _testmain.go:121 +0x236
==================

But I don't see how your change has caused this. 😕

[ghost]

/test tekton-pipeline-unit-tests

[ghost]

Looks like the UT race was a flake :/

/test pull-tekton-pipeline-alpha-integration-tests