Skip to content

Commit a2af438

Browse files
mvanhorntekton-robot
authored andcommitted
docs(install): fix broken OpenShift namespaces link
The previous link (docs.openshift.com/container-platform/latest/welcome/ index.html#about-namespaces) redirected to a generic Welcome page where the #about-namespaces anchor no longer resolves to the relevant section. Replace with the canonical docs.redhat.com page for 'Working with projects', which contains the exact 'Do not run workloads in or share access to default projects' guidance that matches the link text and explains the 'highly privileged' classification of the default project. Signed-off-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
1 parent 273cd27 commit a2af438

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

docs/install.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,6 @@ To configure images from a custom registry, follow the [Air Gap Configuration](.
3737
3838
On OpenShift, the `default` namespace is classified as a "highly privileged" system namespace. Pod Security Admission (PSA) label synchronization is permanently disabled there by the platform, so even though the operator correctly creates the `pipeline` ServiceAccount and RBAC bindings in `default`, PipelineRuns submitted to that namespace fail with `permissionDenied` errors: PSA enforces the `restricted` profile and the SCC-to-PSA label sync never runs.
3939
40-
User-created namespaces are not affected because the Cluster Policy Controller automatically syncs SCC privileges into PSA labels. The OpenShift documentation has the same guidance ([Do not run workloads in or share access to default projects](https://docs.openshift.com/container-platform/latest/welcome/index.html#about-namespaces)).
40+
User-created namespaces are not affected because the Cluster Policy Controller automatically syncs SCC privileges into PSA labels. The OpenShift documentation has the same guidance ([Do not run workloads in or share access to default projects](https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/building_applications/projects)).
4141
4242
Run pipelines in a dedicated namespace instead of `default` on OpenShift. See [tektoncd/operator#3427](https://github.com/tektoncd/operator/issues/3427) for the original report.

0 commit comments

Comments
 (0)