`tekton-operator-proxy-webhook` pod does not come up with `make apply`

[concaf]

make TARGET=openshift apply apply-cr created a tekton-operator-proxy-webhook pod in openshift-pipelines namespace which fails with a CreateContainerError.

Expected Behavior

All pods come up fine

Actual Behavior

tekton-operator-proxy-webhook pod in openshift-pipelines namespace fails with a CreateContainerError.

Upon describing the pod, I get an error saying:

CreateContainerError "container_linux.go:366: starting container process caused: chdir to cwd (\"/home/nonroot\") set in config.json failed: permission denied

Steps to Reproduce the Problem

1. Run make TARGET=openshift apply apply-cr on an OpenShift cluster

Additional Info

This can be worked around by running - kubectl create clusterrolebinding serviceaccounts-cluster-admin --clusterrole=cluster-admin --group=system:serviceaccounts OR by replacing the base image.

• Kubernetes version:

$ kubectl version
Client Version: version.Info{Major:"1", Minor:"20", GitVersion:"v1.20.4", GitCommit:"e87da0bd6e03ec3fea7933c4b5263d151aafd07c", GitTreeState:"clean", BuildDate:"2021-02-18T16:12:00Z", GoVersion:"go1.15.8", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"20", GitVersion:"v1.20.0+bd9e442", GitCommit:"bd9e4421804c212e6ac7ee074050096f08dda543", GitTreeState:"clean", BuildDate:"2021-02-11T23:05:38Z", GoVersion:"go1.15.5", Compiler:"gc", Platform:"linux/amd64"}

$ oc version
oc v3.11.0+0cbc58b
kubernetes v1.11.0+d4cacc0
features: Basic-Auth GSSAPI Kerberos SPNEGO

Server https://server1.concaf:6443
kubernetes v1.20.0+bd9e442

• Tekton Pipeline version:

$ tkn version
Client version: dev
Pipeline version: v0.19.0
Triggers version: v0.10.2

[tekton-robot]

Issues go stale after 90d of inactivity. Mark the issue as fresh with /remove-lifecycle stale with a justification. Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with /close with a justification. If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle stale

Send feedback to tektoncd/plumbing.

[vdemeester]

/lifecycle frozen