The OpenShift Pipelines TektonConfig targetNamespace can cause other workloads to fail

Issue

• Changing the targetNamespace in the TektonConfig from the default openshift-pipelines can cause other workloads to break if you use a shared namespace
• The OpenShift Pipelines targetNamespace applies some Tekton specific annotations to the targetNamespace including an enforcing Pod Security Admission annotation security.kubernetes.io/enforce: restricted
• Any pod that requires higher than the restricted SCC will fail to start with a PodSecurity violation

message: 'pods "advanced-pod-sww2z" is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false
(container "kube-rbac-proxy" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "advanced", "kube-rbac-proxy" must set
securityContext.capabilities.drop=["ALL"]), seccompProfile (pod or containers "advanced", "kube-rbac-proxy" must set securityContext.seccompProfile.type to
"RuntimeDefault" or "Localhost")'