Updated git-clone task

[matejvasek]

Changes

• Updated git fetch task to newer version that is now rootless.

This changes are also already included in the "Go s2i on cluster build" PR.

[knative-prow]

@matejvasek: The label(s) kind/<kind> cannot be applied, because the repository doesn't have them.

In response to this:

Changes

/kind

Fixes #

Release Note

Docs

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[knative-prow]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[knative-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: matejvasek

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [matejvasek]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 50.64%. Comparing base (8f7dd2c) to head (20bd907).

❗ There is a different number of reports uploaded between BASE (8f7dd2c) and HEAD (20bd907). Click for more details.

HEAD has 6 uploads less than BASE

Flag	BASE (8f7dd2c)	HEAD (20bd907)
unit-tests-macos-latest	1	0
unit-tests-ubuntu-latest	1	0
unit-tests-windows-latest	1	0
e2e-test	1	0
integration-tests	1	0
e2e-test-oncluster	1	0

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #2469       +/-   ##
===========================================
- Coverage   61.19%   50.64%   -10.56%     
===========================================
  Files         130      128        -2     
  Lines       15354    11933     -3421     
===========================================
- Hits         9396     6043     -3353     
- Misses       5032     5183      +151     
+ Partials      926      707      -219     

Flag	Coverage Δ
e2e-test	?
e2e-test-oncluster	?
integration-tests	?
unit-tests-macos-latest	?
unit-tests-ubuntu-latest	?
unit-tests-windows-latest	?

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[matejvasek]

PTAL @lkingland @matzew @gauron99

[matejvasek]

/hold

[lkingland]

What happens if this setting were just removed? This default group ID, and runAsGroup below, and the fsGroup setting? Is it possible that explicitly setting these to 0 is what caused the problem in the first place?

[matejvasek]

The primary problem is that that uid is changed, not gid. This causes that git-fetch task on second run cannot clean up the volume. I fixed it by setting gid to match gid of git-fetch task (and also fsGroup) and by setting write access to said group on line 111.

TBH I have no idea why the gid here was set to 0 here. Zbynek implemented it that way long ago.
IMO the gid should be 1000 to match buildpack builder, but it works also with 65532.

I suspect I could just s/65532/1000/g on this PR and it still would work. But I am not sure.

[matejvasek]

This whole ceremony here can be ignored on OCP. OCP automatically sets fsGroup and also adds write perms for the group.
Actually on OCP you must not set podTemplate.securityContext, otherwise there will be error.

[matejvasek]

The primary problem is that that uid is changed, not gid.

This and the fact that set gid works oddly or not at all.

[matejvasek]

@lkingland we may also opt not to do this update and keep rootfull git-clone. We just will have to also make func-utils image rootfull to. See #2471